40776d235f947719b30e997a13a6fef960699e96b01a417c7b2db5d57f4fceea

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40776d235f947719b30e997a13a6fef960699e96b01a417c7b2db5d57f4fceea.exe
Size

39KB
MD5

2488816970f486929443abf6f4a5e548
SHA1

69979fac6556152c1f86a7f34f4c30f0916d9d01
SHA256

40776d235f947719b30e997a13a6fef960699e96b01a417c7b2db5d57f4fceea
SHA512

08e5e0b60d1cae7710b886ec28f32d5f44f63d937a5efd4d62444882f5e1d3799fb7efd19331678ecfd269fc86a0ddfd4b4994743d6bfae9d0d697cb132e1ed9
SSDEEP

768:E8eRH+9lFh0ul16sh7iQroCHaf+RjFBSuB2X8:E9l+Z16sh7iQroC1RB0u5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	40776d235f947719b30e997a13a6fef960699e96b01a417c7b2db5d57f4fceea.exe

Executes dropped EXE 1 IoCs

pid	Process
3012	bkgrnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3012	2796	40776d235f947719b30e997a13a6fef960699e96b01a417c7b2db5d57f4fceea.exe	82
PID 2796 wrote to memory of 3012	2796	40776d235f947719b30e997a13a6fef960699e96b01a417c7b2db5d57f4fceea.exe	82
PID 2796 wrote to memory of 3012	2796	40776d235f947719b30e997a13a6fef960699e96b01a417c7b2db5d57f4fceea.exe	82

C:\Users\Admin\AppData\Local\Temp\40776d235f947719b30e997a13a6fef960699e96b01a417c7b2db5d57f4fceea.exe
"C:\Users\Admin\AppData\Local\Temp\40776d235f947719b30e997a13a6fef960699e96b01a417c7b2db5d57f4fceea.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe
  "C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe"
  2⤵
  - Executes dropped EXE
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe

Filesize
39KB

MD5
e1582e25d0b4148bdc930cf5f7ff23d1

SHA1
68450c698d01a13574e8b3ad1872c9564cad6e84

SHA256
34b43d756df42be88bc4e942b6fc9c11111905e6d4f38f2e114fa1e5228a44fe

SHA512
cdcdfa226c76e8753549e52a12024672b5df023ba9a54431494dc83fdd4c784b8bf7ce20429933290fc9aa399c24ae3118c00e6030b1a88f5cd8cef978a85a5f

Download Submit
memory/2796-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2796-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/2796-2-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/2796-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3012-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download