0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858

Analysis

max time kernel
94s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858.exe
Size

91KB
MD5

28b2fa4b764bc2f2d92d89b77b33e254
SHA1

e9512c83aa7cdb105e4cb978e0958bc9989ca2b8
SHA256

0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858
SHA512

c1922a62bf540661cb43d6686e38f9cd7efc4ea29eef5cc4dacf1069a740c8f69306fad943773740a75664de1f7c2b03320ba533a0e128de51e8f8c15c264f47
SSDEEP

1536:DS7nK8eztdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsyPibdF45jYl7JJUj23p9:DJtdgI2MyzNORQtOflIwoHNV2XBFV72u

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858.exeffengh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	ffengh.exe

Executes dropped EXE 1 IoCs

Processes:

ffengh.exe

pid process

4480 ffengh.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4480	ffengh.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858.exe

description	pid	process	target process
PID 2412 wrote to memory of 4480	2412	0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858.exe	ffengh.exe
PID 2412 wrote to memory of 4480	2412	0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858.exe	ffengh.exe
PID 2412 wrote to memory of 4480	2412	0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858.exe	ffengh.exe

C:\Users\Admin\AppData\Local\Temp\0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858.exe
"C:\Users\Admin\AppData\Local\Temp\0a644c46738228c0c0addb62584916084bf489116f09f9e94b8743cd474df858.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2412

C:\Users\Admin\AppData\Local\Temp\ffengh.exe
"C:\Users\Admin\AppData\Local\Temp\ffengh.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4480

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ffengh.exe
Filesize
91KB

MD5
b5c35a7a54017cd688115a97b7af9c91

SHA1
515083939b0cc5185022fdfcd8f78763438a9bbf

SHA256
08a1048a6d9605f3becdba2b1005840d6b449cb8b256a7a1e838ed9c2c3f83bd

SHA512
7ee4b6eb1d28ac1923ddb482527df0596c81a1d11d025ca0b3cb5a8557cb1c8ca108792de558bece4430b7d7c4b7734e43bfda95f69bcd91cb86b01eecfe3cb0

Download Submit
memory/2412-0-0x0000000000590000-0x0000000000597000-memory.dmp

Filesize
28KB

Download
memory/2412-6-0x0000000000590000-0x0000000000597000-memory.dmp

Filesize
28KB

Download
memory/2412-1-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download