baae3127acf477fafa20bcbf3f3d6d63c73cb541236844841708136bea574d4e

Analysis

max time kernel
138s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HWID Spoofer/EAC.exe
Size

369KB
MD5

0c3782a8b51ea97e045c0ed6a4039e68
SHA1

0ea4d987b61703a347971f8591c49677518b7cd9
SHA256

814a018f079e559b946da2d6ecf214cfc4c885ad3b91304bdd2afa80d311607f
SHA512

5b9e871ab22f8383c2181401a433335053c412aa1650f9d0e94ff5e3dc578f5d147e089baebc7af9ee28618d050af5021142da2a04decc6bbce8e3bbd9c3554d
SSDEEP

3072:T2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXSS:6bJhs7QW69hd1MMdxPe9N9uA0hu9TBXS

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	EAC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 4960	1752	EAC.exe	84
PID 1752 wrote to memory of 4960	1752	EAC.exe	84

C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\EAC.exe
"C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\EAC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6D6F.tmp\6D70.tmp\6D71.bat "C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\EAC.exe""
  2⤵
  PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6D6F.tmp\6D70.tmp\6D71.bat

Filesize
157B

MD5
2589606b7956b75cab7fcf07a790cfdb

SHA1
e2dc35d66a3aa433860f5ff0703e8ef16568cadb

SHA256
30c09f6c2575af3f137a2a8cb4dc78768f68535b2f70a965ca0595dd0ac07ffd

SHA512
2721c0e329c1dfa3fcd1932558c5ad4f6f58a3134105b1eccc9aff3748952ca69ea176596ce29b96a2984306f1532e3fc9ac4610fab0de09dcccf571665ead73

Download Submit