921737ab95f8ca1caac680b10b49c03e84a33e169fdd900ed31ad0f3420b3197

Analysis

max time kernel
141s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

921737ab95f8ca1caac680b10b49c03e84a33e169fdd900ed31ad0f3420b3197.exe
Size

23KB
MD5

97b75b6ed5cfab625aa343ed904b82ac
SHA1

0b2832187b49efbf5652eb46409db002096cfdaa
SHA256

921737ab95f8ca1caac680b10b49c03e84a33e169fdd900ed31ad0f3420b3197
SHA512

c087df49d0fbc87cd915d41f29b1a83ea6533eee60235e8e6b73d3be16a245ec21cb3824f94232770a35ba1a5aba85c30f779b68a4017b321670e1a2f4b0fbad
SSDEEP

384:IYir3Vf2dzjGdwMZwOvcAr1qXVIT9Ui5ewcjv9L6ppEp7vKz:IrTVuFqbwUcAr1qXVITuX5jFrp78

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	921737ab95f8ca1caac680b10b49c03e84a33e169fdd900ed31ad0f3420b3197.exe

Executes dropped EXE 1 IoCs

pid	Process
3140	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	921737ab95f8ca1caac680b10b49c03e84a33e169fdd900ed31ad0f3420b3197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	budha.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 3140	1476	921737ab95f8ca1caac680b10b49c03e84a33e169fdd900ed31ad0f3420b3197.exe	92
PID 1476 wrote to memory of 3140	1476	921737ab95f8ca1caac680b10b49c03e84a33e169fdd900ed31ad0f3420b3197.exe	92
PID 1476 wrote to memory of 3140	1476	921737ab95f8ca1caac680b10b49c03e84a33e169fdd900ed31ad0f3420b3197.exe	92

C:\Users\Admin\AppData\Local\Temp\921737ab95f8ca1caac680b10b49c03e84a33e169fdd900ed31ad0f3420b3197.exe
"C:\Users\Admin\AppData\Local\Temp\921737ab95f8ca1caac680b10b49c03e84a33e169fdd900ed31ad0f3420b3197.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
1⤵
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0KP8BKDN\opt-in-graphic2[1].htm

Filesize
167B

MD5
0104c301c5e02bd6148b8703d19b3a73

SHA1
7436e0b4b1f8c222c38069890b75fa2baf9ca620

SHA256
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

SHA512
84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
23KB

MD5
56f75cf9b850ac93304f89bf350a01bb

SHA1
f19a18fc8655edb9235276e5e524fc785fdb3072

SHA256
4e577125453165eadfb530d4b3f7f204cff45b37e9237cb8c3ce850e79f5fc1e

SHA512
807d96e82ddf7e71e047f82e8752e05b5cc0bbf4381a7b0b91ded1ee74a11b98b3751b5bc2a0b2bb016c18e6f1f7ad1c8089f28d72115bfc11b68964faf4d750

Download Submit
memory/1476-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1476-1-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/1476-3-0x0000000002820000-0x0000000002C20000-memory.dmp

Filesize
4.0MB

Download
memory/1476-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3140-14-0x00000000027B0000-0x0000000002BB0000-memory.dmp

Filesize
4.0MB

Download
memory/3140-13-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/3140-31-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download