cf8da079bd31e14ee0e74e74d48e65866ad8a8f04730748501b0a296341a9ee1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_9dee0db8fa8f8cd432475152448cfbe8.exe
Size

912KB
MD5

9dee0db8fa8f8cd432475152448cfbe8
SHA1

13c29a057220ea0766894f43067475b5254e4c6d
SHA256

cf8da079bd31e14ee0e74e74d48e65866ad8a8f04730748501b0a296341a9ee1
SHA512

b0c59b1c16f95ddfdc5b428696a8401c0867442ed853fbe2c17e39d348be58d13a80e85d5171852bee4a31333f4aa954bdac835c2dfd095b9833cc785035a809
SSDEEP

12288:taWzgMg7v3qnCiMErQohh0F4CCJ8lnyC8rdoH8DV8ILm5sCc0KAQ6EFsgj:saHMv6CorjqnyC8xlDx6JKAl2j

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	VirusShare_9dee0db8fa8f8cd432475152448cfbe8.exe

Executes dropped EXE 1 IoCs

pid	Process
3448	uncrypted.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2932-0-0x0000000000400000-0x00000000004D3000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3448	2932	VirusShare_9dee0db8fa8f8cd432475152448cfbe8.exe	83
PID 2932 wrote to memory of 3448	2932	VirusShare_9dee0db8fa8f8cd432475152448cfbe8.exe	83
PID 2932 wrote to memory of 3448	2932	VirusShare_9dee0db8fa8f8cd432475152448cfbe8.exe	83

C:\Users\Admin\AppData\Local\Temp\VirusShare_9dee0db8fa8f8cd432475152448cfbe8.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_9dee0db8fa8f8cd432475152448cfbe8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\uncrypted.exe
  "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe"
  2⤵
  - Executes dropped EXE
  PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut3A4A.tmp

Filesize
93KB

MD5
b67ab4175853e47e86a4e7fc2df02395

SHA1
8eff28edfc3e1ed29487e1690a13a0b1ed961a88

SHA256
4e4bc67bf9a5ee51dcf7219ca7291255d793719bbe2f35bc5e45fd4eab0ecef7

SHA512
be4c1fcebdf39bec3674cd58a0f67a50a28dc61839ad52fca054ee83dc3323a4acd905617cfae74ef90bc82b804d45b63289cab79ec9a3c847b0fb37d9c12be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\uncrypted.exe

Filesize
93KB

MD5
eb61757fb15237f1e2f38d90740cbca4

SHA1
fc7656b01612b83ba106d4ab9b231c0f8ee9e513

SHA256
b5ee941521219c1a3a89979021fdfb9f941474f646bb5b8ff81030e67255553a

SHA512
fba00459582e78df7d5f4ab2dc653517a40683c9175b4ad82ac6301ada0c1229260e2a0cb2e6755ef351204cd211247e11adbd9e035238cad2992871c99e828f

Download Submit
memory/2932-0-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download