b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5.exe
Size

415KB
MD5

c4aeaafc0507785736e000ff7e823f5e
SHA1

b1acdee835f02856985a822fe99921b097ed1519
SHA256

b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5
SHA512

fbaefbce3232481490bce7b859c6c1bafd87ee6d952a2be9bf7c4ed25fe8fc9aff46c2246e247aa05ce8e405831a5905ca366c5333ede0af48f9a6287479a12d
SSDEEP

12288:pfSPtGpmLb84Jjzo6yrBuKuJ+ITOClUd:ktGpmf8edykhVlUd

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5.exe

Executes dropped EXE 4 IoCs

pid	Process
4868	Hkbsse.exe
4988	Hkbsse.exe
4284	Hkbsse.exe
2440	Hkbsse.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Hkbsse.job	b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4868	1124	b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5.exe	86
PID 1124 wrote to memory of 4868	1124	b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5.exe	86
PID 1124 wrote to memory of 4868	1124	b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5.exe	86

C:\Users\Admin\AppData\Local\Temp\b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5.exe
"C:\Users\Admin\AppData\Local\Temp\b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
  "C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe"
  2⤵
  - Executes dropped EXE
  PID:4868

C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4988

C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe

Filesize
415KB

MD5
c4aeaafc0507785736e000ff7e823f5e

SHA1
b1acdee835f02856985a822fe99921b097ed1519

SHA256
b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5

SHA512
fbaefbce3232481490bce7b859c6c1bafd87ee6d952a2be9bf7c4ed25fe8fc9aff46c2246e247aa05ce8e405831a5905ca366c5333ede0af48f9a6287479a12d

Download Submit