Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-08-2024 12:35

General

  • Target

    78743c3f85b3485ec2a49a07529bc760N.exe

  • Size

    370KB

  • MD5

    78743c3f85b3485ec2a49a07529bc760

  • SHA1

    6efd2968bdbd316657417c708387bcb946ec714b

  • SHA256

    fd63c2da89f16a4a2db0a86f79472a72ffd4330458d12201fa0571dc94a1f28f

  • SHA512

    c7c65c2c921c59810ae754dd575222182900e7c5d88010df99da1ff952f1f5fab6e41ee66d40aca40195f28a79cb6e1c89e8c6132c5b59b73d691b6aa80ceea6

  • SSDEEP

    6144:CuJkl8DV12C28tLN2/FkCO0aHftvCGCBhDOHjTPmXHk62pHj:CzGL2C2aZ2/F1XaveOHjTn

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78743c3f85b3485ec2a49a07529bc760N.exe
    "C:\Users\Admin\AppData\Local\Temp\78743c3f85b3485ec2a49a07529bc760N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Users\Admin\AppData\Local\Temp\uxumh.exe
      "C:\Users\Admin\AppData\Local\Temp\uxumh.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    8007db22973fa49184ba65ae2350178b

    SHA1

    170d310e840a1c7c11db01c5c84a9604e4c22301

    SHA256

    c09c90f054686d30cc3aba3b62300cfd5b46e389809d938255ea186f79acdeb0

    SHA512

    775ac014c069a69d225e679e50684bbc32d757c4c068e07d32a5f62b25f2ec93daf98b1e84afea7117c28c92915836845c8f77faa197409391757da061277db6

  • C:\Users\Admin\AppData\Local\Temp\uxumh.exe

    Filesize

    370KB

    MD5

    67fe85901cbfe05bf6852001fb2ce761

    SHA1

    0c353b3c4d080359d521c53597e5883fdad8e95f

    SHA256

    4c226733d8f3a5743200e61ffc91bdd7b785a04041669c30c097d9ef67cf8ee4

    SHA512

    e05d89149fc7a89ab861fbb4ff43c96391279324e092bfd46dc1fa4ef8f4cb12ef8b7a24c04168b44e6cc42edaab41fa56a7bf11c1b2c13d141b1b006c65483d