0a711b4985a1dffcbd564190a8469a5a786fd84598e647c423d49367f7151c75

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9ac2993e4d47df6c212ace5dec27303.exe
Size

37KB
MD5

e9ac2993e4d47df6c212ace5dec27303
SHA1

87f29f5e66fd9cfdee667e7b7c552701b7ef559f
SHA256

0a711b4985a1dffcbd564190a8469a5a786fd84598e647c423d49367f7151c75
SHA512

31ffcc8fdc810c4721b2d1ddc7ef61daf53f42323fbe9653d5e4195ef4c6436acd58ce2e671c6898a4523f3ed1610064145e0a90fc50bc8eee7faa22ff9e4c7e
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA6lx1huah:bA74zYcgT/Ekd0ryfjPIunqpeNswm6X

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	e9ac2993e4d47df6c212ace5dec27303.exe

Executes dropped EXE 1 IoCs

pid	Process
536	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 536	2044	e9ac2993e4d47df6c212ace5dec27303.exe	82
PID 2044 wrote to memory of 536	2044	e9ac2993e4d47df6c212ace5dec27303.exe	82
PID 2044 wrote to memory of 536	2044	e9ac2993e4d47df6c212ace5dec27303.exe	82

C:\Users\Admin\AppData\Local\Temp\e9ac2993e4d47df6c212ace5dec27303.exe
"C:\Users\Admin\AppData\Local\Temp\e9ac2993e4d47df6c212ace5dec27303.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
37KB

MD5
9d323dd86ad1393ee8c72aa33b76af76

SHA1
396812746ccd7a81a09799a91b87f968f5c46973

SHA256
4acbf396ccc51bf132a3cc422faeab904025b260574de47934d196fbb8db5e05

SHA512
74d24064865540140188a00d95b6752f0a4caaed64e6949a422f46d9f94401b4a02ca4935f968a6ec1f84f2b35dc9ec7826a0fb4a1107c07f8b5aa2a9f49fee2

Download Submit
memory/536-17-0x00000000023C0000-0x00000000023C6000-memory.dmp

Filesize
24KB

Download
memory/536-23-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/2044-0-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2044-1-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/2044-8-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download