1a19c8a7ac9b773d1478c8493ac8ab1ceb37ed211cd3f0b8fd2025c1537bd154

Analysis

max time kernel
129s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a19c8a7ac9b773d1478c8493ac8ab1ceb37ed211cd3f0b8fd2025c1537bd154.exe
Size

33KB
MD5

c84a6cab70f3c2540a2bb26ac17c81a0
SHA1

cef6de4271578d17b32ab900db4df087a3f0cdd3
SHA256

1a19c8a7ac9b773d1478c8493ac8ab1ceb37ed211cd3f0b8fd2025c1537bd154
SHA512

e3c68453a7b3676557c90fe65fb695d99a36d0094dd86117886578e15f47c859ffbb3ef8390fc3d93ba84ddcfe6300cd417186519f112becaed199840ae9e207
SSDEEP

768:sAI5y4MnESa8AWo6/yaAW7++KvWqrOeecNa0SGwnfY3:skEuA2aaAW7s5XjY0SDfY3

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Control Panel\International\Geo\Nation	1a19c8a7ac9b773d1478c8493ac8ab1ceb37ed211cd3f0b8fd2025c1537bd154.exe

Executes dropped EXE 1 IoCs

pid	Process
624	ieupdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 624	2600	1a19c8a7ac9b773d1478c8493ac8ab1ceb37ed211cd3f0b8fd2025c1537bd154.exe	82
PID 2600 wrote to memory of 624	2600	1a19c8a7ac9b773d1478c8493ac8ab1ceb37ed211cd3f0b8fd2025c1537bd154.exe	82
PID 2600 wrote to memory of 624	2600	1a19c8a7ac9b773d1478c8493ac8ab1ceb37ed211cd3f0b8fd2025c1537bd154.exe	82

C:\Users\Admin\AppData\Local\Temp\1a19c8a7ac9b773d1478c8493ac8ab1ceb37ed211cd3f0b8fd2025c1537bd154.exe
"C:\Users\Admin\AppData\Local\Temp\1a19c8a7ac9b773d1478c8493ac8ab1ceb37ed211cd3f0b8fd2025c1537bd154.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\ieupdate.exe
  "C:\Users\Admin\AppData\Local\Temp\ieupdate.exe"
  2⤵
  - Executes dropped EXE
  PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ieupdate.exe

Filesize
33KB

MD5
e53c8e939fba3b337e1f87ae60b68525

SHA1
621da6af844de439c7c11a7b91ed856817c6bbc9

SHA256
52603b8e83b4eb91d1dbaba25dbdd1d66d2a54767aca44d0efe69ccda779e5c0

SHA512
907f443c288e2ba11f3555174fab105ee7274800230bf65a14e4755b448ddbc110345ac5e58284a4ad966a71f72ac28d7df8d85be106dd3b22a1d2f53d23907a

Download Submit
memory/624-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2600-0-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download