12402c515e9a42ffae363a42be0bc71e91d2844f39571b2525c6dd92c9fd5e05

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b8222af8872cac0ed9006ab0a4b6b80N.exe
Size

46KB
MD5

6b8222af8872cac0ed9006ab0a4b6b80
SHA1

2552c1946d93e19ae0517d5f9d9e88ad8c13c566
SHA256

12402c515e9a42ffae363a42be0bc71e91d2844f39571b2525c6dd92c9fd5e05
SHA512

a39bf36e05d15d34175b443dd9d594969e283d3a75f93d46e449f54b45b30d03a9a7febb6d6e153882b09017e5b99fd4047939897f1b7f97e3175a89e10f4900
SSDEEP

768:OgQsqgf3ml06sh7iQroCHWKYOgOjSuLjSI6CF6BSz5k8p7:ONsE06sh7iQroCdpgO2uLjF6M1

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	6b8222af8872cac0ed9006ab0a4b6b80N.exe

Executes dropped EXE 1 IoCs

pid	Process
2348	pnit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6b8222af8872cac0ed9006ab0a4b6b80N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 2348	3512	6b8222af8872cac0ed9006ab0a4b6b80N.exe	85
PID 3512 wrote to memory of 2348	3512	6b8222af8872cac0ed9006ab0a4b6b80N.exe	85
PID 3512 wrote to memory of 2348	3512	6b8222af8872cac0ed9006ab0a4b6b80N.exe	85

C:\Users\Admin\AppData\Local\Temp\6b8222af8872cac0ed9006ab0a4b6b80N.exe
"C:\Users\Admin\AppData\Local\Temp\6b8222af8872cac0ed9006ab0a4b6b80N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Users\Admin\AppData\Local\Temp\pnit.exe
  "C:\Users\Admin\AppData\Local\Temp\pnit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pnit.exe

Filesize
46KB

MD5
a8eeb70c4a8293b260fdb21399b0d75e

SHA1
55ac98f3c9da6c1545e6b2ed8f056080d553399c

SHA256
d2ff45915b008b850b1ef018055cbe093aa061a06789ddcd84b2f7c579b91b39

SHA512
e9102d9ab07b99e964f6debd3de65493febc4939f65013b37472540fae170c1f16aee61915102a6aae973d020267576360e2b894e4d8d156922edc55535b1adf

Download Submit
memory/3512-0-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/3512-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download