747e36b8700d2ad87706f5233da4b84a237e3d701ba826205d3b3e8cff2e7acf

Analysis

max time kernel
149s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
747e36b8700d2ad87706f5233da4b84a237e3d701ba826205d3b3e8cff2e7acf.exe
Size 35KB
Sample240602-3m4zmsce33
SHA256 747e36b8700d2ad87706f5233da4b84a237e3d701ba826205d3b3e8cff2e7acf
MD5 4cf557977b9c6053a7d2e9c985e798dd
SHA1 b49ef6c6c95b5e8d501295aa51e234783224c0a7
SHA512 88bd4a0e0b19523b902d4a1b4aecdc8788342775cf986e6161feba7044813276492cd2a1fbc666f93ff1bbebf3ae0343a37ab8a06b1afca29d235e67527ca1b8
SSDEEP 768:6B7HBXFw82t2C80lyaZ4jX05Rftleo9LXmIt:u7HZFwzlyaZTNAa/t
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	747e36b8700d2ad87706f5233da4b84a237e3d701ba826205d3b3e8cff2e7acf.exe

Executes dropped EXE 1 IoCs

pid	Process
448	cnwog.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 448	4516	747e36b8700d2ad87706f5233da4b84a237e3d701ba826205d3b3e8cff2e7acf.exe	81
PID 4516 wrote to memory of 448	4516	747e36b8700d2ad87706f5233da4b84a237e3d701ba826205d3b3e8cff2e7acf.exe	81
PID 4516 wrote to memory of 448	4516	747e36b8700d2ad87706f5233da4b84a237e3d701ba826205d3b3e8cff2e7acf.exe	81

C:\Users\Admin\AppData\Local\Temp\747e36b8700d2ad87706f5233da4b84a237e3d701ba826205d3b3e8cff2e7acf.exe
"C:\Users\Admin\AppData\Local\Temp\747e36b8700d2ad87706f5233da4b84a237e3d701ba826205d3b3e8cff2e7acf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\cnwog.exe
  "C:\Users\Admin\AppData\Local\Temp\cnwog.exe"
  2⤵
  - Executes dropped EXE
  PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cnwog.exe

Path C:\Users\Admin\AppData\Local\Temp\cnwog.exe
Size 36KB
SHA256 b88c3b35ea3df7c3a81618cfbbade05d6d558a36ebee007605d4fcd471753cfd
MD5 6ee8a8e62290ee5522118359977cfb15
SHA1 e41b9697bd2fbd89ed3777aa647282df101c6560
SHA512 0edae0b152b99792000918f224547bacab9e5cf86a7f4f295b11038c1fc84778f0f9288d1f35294116b6ce15784c73ed09a3e15207eec36112cc1efd07af416f
SSDEEP 768:6B7HBXFw82t2C80lyaZ4jX05Rftleo9LXmII:u7HZFwzlyaZTNAa/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/448-10-0x00000000007B0000-0x00000000007B3000-memory.dmp

Download

memory/4516-0-0x00000000007F0000-0x00000000007F3000-memory.dmp