4871629d91343265fe70384290bbf8a8de66408420fb49ca49acaadf8bf81a4b

Analysis

max time kernel
0s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4871629d91343265fe70384290bbf8a8de66408420fb49ca49acaadf8bf81a4b.exe
Size

33KB
MD5

946b656cc631c26884efee8aa7bbcaa2
SHA1

00572d0ae8f02cf18e534d780269d7aa7aa4f6b4
SHA256

4871629d91343265fe70384290bbf8a8de66408420fb49ca49acaadf8bf81a4b
SHA512

50b14308365f33807bc0c47c087c7f75e3d31a225b825bcb2e8c4459fe44787cc908346badf18b3d768344147833dc7fdfb65005675a16e40b178e5b957f7892
SSDEEP

384:UzITNKpJWmdLd/zNdKNPw5MQfjWpjLS4wVQJbxVRJ5hlXa:UMT+JB4dQStLrVVXh9a

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	4871629d91343265fe70384290bbf8a8de66408420fb49ca49acaadf8bf81a4b.exe

Executes dropped EXE 1 IoCs

pid	Process
1376	kgfdfjdk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1376	1904	4871629d91343265fe70384290bbf8a8de66408420fb49ca49acaadf8bf81a4b.exe	80
PID 1904 wrote to memory of 1376	1904	4871629d91343265fe70384290bbf8a8de66408420fb49ca49acaadf8bf81a4b.exe	80
PID 1904 wrote to memory of 1376	1904	4871629d91343265fe70384290bbf8a8de66408420fb49ca49acaadf8bf81a4b.exe	80

C:\Users\Admin\AppData\Local\Temp\4871629d91343265fe70384290bbf8a8de66408420fb49ca49acaadf8bf81a4b.exe
"C:\Users\Admin\AppData\Local\Temp\4871629d91343265fe70384290bbf8a8de66408420fb49ca49acaadf8bf81a4b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe
  "C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe"
  2⤵
  - Executes dropped EXE
  PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe

Filesize
33KB

MD5
80b54adeb6dd5691df04c53535a460c0

SHA1
8b322cc8eb5e24e4336364ca82949deee9827c45

SHA256
8e4b70e45de1ec1558605b1e4e7677fbff402e187ff2055224141e4e1f328730

SHA512
3652e0c81f141f14f12ca0c3ab61c4fcad9d14a7421e605e9cd133c9b55a93f0053e83284d6123682c9eeeb55c9a542f0f53f8a2bc099a9d72fda95eae9d16b2

Download Submit