abb8e893a7220cef1d0c27a5557c3631f6caa989d2784197875629319a4b34d1

Analysis

max time kernel
95s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7de0bb16f04494245d7624a5a44f3760N.exe
Size

52KB
MD5

7de0bb16f04494245d7624a5a44f3760
SHA1

cd301fe4533aad83f14cc5cf30f6edd273e15347
SHA256

abb8e893a7220cef1d0c27a5557c3631f6caa989d2784197875629319a4b34d1
SHA512

70a557b67e1eec5c71ef17dd440eb7344efcf182fae0b2004c6e1cc66ae4d86e86bf181a098e84078dc0f0d7a972a1561797b4dc2f327867be4d67a4001cd782
SSDEEP

384:cnwR2F5SMtoLIYi4aYiyYNHsbDAez7Nu6NMVvz3g3hNAbhNp8yC:KwR1pjiy4Rez7Nuxh4

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7de0bb16f04494245d7624a5a44f3760N.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	7de0bb16f04494245d7624a5a44f3760N.exe

Executes dropped EXE 1 IoCs

Processes:

hummy.exe

pid process

5024 hummy.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5024	hummy.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7de0bb16f04494245d7624a5a44f3760N.exehummy.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7de0bb16f04494245d7624a5a44f3760N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hummy.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7de0bb16f04494245d7624a5a44f3760N.exe

description	pid	process	target process
PID 1272 wrote to memory of 5024	1272	7de0bb16f04494245d7624a5a44f3760N.exe	hummy.exe
PID 1272 wrote to memory of 5024	1272	7de0bb16f04494245d7624a5a44f3760N.exe	hummy.exe
PID 1272 wrote to memory of 5024	1272	7de0bb16f04494245d7624a5a44f3760N.exe	hummy.exe

C:\Users\Admin\AppData\Local\Temp\7de0bb16f04494245d7624a5a44f3760N.exe
"C:\Users\Admin\AppData\Local\Temp\7de0bb16f04494245d7624a5a44f3760N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Admin\AppData\Local\Temp\hummy.exe
"C:\Users\Admin\AppData\Local\Temp\hummy.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hummy.exe

Filesize
52KB

MD5
0040b6906514f0749ab4fe7533c5d8ad

SHA1
4abc4f1354d33862103e5b77f47d450be2554e3f

SHA256
4c3eb5256ee1a337b53aa7b95f4a91375de1df6997addf1ca80a7a55404b1b8a

SHA512
bded521416820620683cbe04b4a9ef810fb558d7bc1eb96c9be4ea868ce177e888dd6dadb9b16a8fbe9871925264f56d26fcd9a44cf7959e618bf7b7f7827ae8

Download Submit
memory/1272-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1272-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download