Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2024 12:58

General

  • Target

    64d005d21bde2853ff20513330ea8ead067cf280472265810969ecea6c934cc2.exe

  • Size

    28KB

  • MD5

    1b6a59b99b085a03e7c4e87fe6cbefd6

  • SHA1

    93e2b952970854a880cc3822c2eb4a8b78128c70

  • SHA256

    64d005d21bde2853ff20513330ea8ead067cf280472265810969ecea6c934cc2

  • SHA512

    9d11d111c4b75595a75d467f1c4cb84e66550fa9df1e5b7ea8266b48e82379bfa933c4974a2975dda8f4747a5c16fd87b786d6381579a8b3e386553b82a79eba

  • SSDEEP

    768:nz3qWc7RY1JgNwmZlj3TIRY7lxxDWBrzG:nzJngNwCjmqxFP

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64d005d21bde2853ff20513330ea8ead067cf280472265810969ecea6c934cc2.exe
    "C:\Users\Admin\AppData\Local\Temp\64d005d21bde2853ff20513330ea8ead067cf280472265810969ecea6c934cc2.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Users\Admin\AppData\Local\Temp\ztdvl.exe
      "C:\Users\Admin\AppData\Local\Temp\ztdvl.exe"
      2⤵
      • Executes dropped EXE
      PID:3624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ztdvl.exe

    Filesize

    29KB

    MD5

    a6b54d7f5e012d9f78f43939a82f226d

    SHA1

    45f3fdf573b41f1918bb6293cc75ef7a85ad4b79

    SHA256

    5f68bbd082d6810d2f9da954ca19f3da6710dba44918424086da65de3d93c5d6

    SHA512

    b04637ff412ebe0ee5b823d83a3d2f267150a415b545eb63df36ee605b4f552cb128ace0626609c393eb092ada69c837d4ad9f75f5c0b5788986fe69d6aa0a43

  • memory/2392-1-0x0000000000402000-0x0000000000403000-memory.dmp

    Filesize

    4KB

  • memory/3624-9-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB