33afef833dcb4dd7102d39dc249f2afed4becf03e2a0c9eea1bed00482b70e3d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33afef833dcb4dd7102d39dc249f2afed4becf03e2a0c9eea1bed00482b70e3d.exe
Size

91KB
MD5

f99326cecbc6e3882561eb2d4c4e586a
SHA1

c91a355104d0c3fff7e62365f5f0073640056ba2
SHA256

33afef833dcb4dd7102d39dc249f2afed4becf03e2a0c9eea1bed00482b70e3d
SHA512

7e92395738fb900f7542b83971301fe8ad16c611fdd7f79a54078dfc63e1ce8d1d13a67b6baf4efab3f630c0fd94e9dc0a503a45b7e60ee62c4e78432dfa735c
SSDEEP

1536:DS7nK8eztdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsyPibdF45jYl7JJUj23p3:DJtdgI2MyzNORQtOflIwoHNV2XBFV72o

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	33afef833dcb4dd7102d39dc249f2afed4becf03e2a0c9eea1bed00482b70e3d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	ffengh.exe

Executes dropped EXE 1 IoCs

pid	Process
3704	ffengh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3704	4908	33afef833dcb4dd7102d39dc249f2afed4becf03e2a0c9eea1bed00482b70e3d.exe	84
PID 4908 wrote to memory of 3704	4908	33afef833dcb4dd7102d39dc249f2afed4becf03e2a0c9eea1bed00482b70e3d.exe	84
PID 4908 wrote to memory of 3704	4908	33afef833dcb4dd7102d39dc249f2afed4becf03e2a0c9eea1bed00482b70e3d.exe	84

C:\Users\Admin\AppData\Local\Temp\33afef833dcb4dd7102d39dc249f2afed4becf03e2a0c9eea1bed00482b70e3d.exe
"C:\Users\Admin\AppData\Local\Temp\33afef833dcb4dd7102d39dc249f2afed4becf03e2a0c9eea1bed00482b70e3d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\ffengh.exe
  "C:\Users\Admin\AppData\Local\Temp\ffengh.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ffengh.exe

Filesize
91KB

MD5
e8196fb561749975a8641c0e1d468df4

SHA1
77bbe200f83567feee78c4e72355339923b8e0a3

SHA256
672fbc7c924fb177c648e2cbead41a5b3d679f8f621e65cded65db6296a7e216

SHA512
9a6b15a91bf9c91e0003e28a59f21116ee9f3baf0085dc35129235f3bf24bde1bd42a24013aeb4154d34c7dd900a33bb51ec941c7ffcb5c0c7e7a92b3b371616

Download Submit
memory/3704-21-0x0000000000660000-0x0000000000667000-memory.dmp

Filesize
28KB

Download
memory/4908-0-0x0000000002130000-0x0000000002137000-memory.dmp

Filesize
28KB

Download
memory/4908-1-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/4908-6-0x0000000002130000-0x0000000002137000-memory.dmp

Filesize
28KB

Download