86b59c40666e50e90f282963672dbe8230444fc24aa2cc6d864ebee93722ebe0

Analysis

max time kernel
127s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86b59c40666e50e90f282963672dbe8230444fc24aa2cc6d864ebee93722ebe0.exe
Size

35KB
MD5

b9284902f83375cf16f559a79f728c29
SHA1

6935b9fc6130cf781f862e81f45d45080ec6895c
SHA256

86b59c40666e50e90f282963672dbe8230444fc24aa2cc6d864ebee93722ebe0
SHA512

2abfd0b1e23f8d11c4c89dc5f53a0bbbe1aeeed3ced86ae1ad1a05a359b05d66b73275720bc4b9dc97fb4a486a26aa8238dc9e1022fb0cf4ba8bf564c1fd2c99
SSDEEP

768:qS7nh4aQC9xIp/tdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsUI+fSkSC:qS7nK8KptdgI2MyzNORQtOflIwoHNV2w

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	86b59c40666e50e90f282963672dbe8230444fc24aa2cc6d864ebee93722ebe0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	ffengh.exe

Executes dropped EXE 1 IoCs

pid	Process
852	ffengh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86b59c40666e50e90f282963672dbe8230444fc24aa2cc6d864ebee93722ebe0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffengh.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 852	436	86b59c40666e50e90f282963672dbe8230444fc24aa2cc6d864ebee93722ebe0.exe	85
PID 436 wrote to memory of 852	436	86b59c40666e50e90f282963672dbe8230444fc24aa2cc6d864ebee93722ebe0.exe	85
PID 436 wrote to memory of 852	436	86b59c40666e50e90f282963672dbe8230444fc24aa2cc6d864ebee93722ebe0.exe	85

C:\Users\Admin\AppData\Local\Temp\86b59c40666e50e90f282963672dbe8230444fc24aa2cc6d864ebee93722ebe0.exe
"C:\Users\Admin\AppData\Local\Temp\86b59c40666e50e90f282963672dbe8230444fc24aa2cc6d864ebee93722ebe0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436
- C:\Users\Admin\AppData\Local\Temp\ffengh.exe
  "C:\Users\Admin\AppData\Local\Temp\ffengh.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ffengh.exe

Filesize
35KB

MD5
1a20934a98c237be4bb6955baae14822

SHA1
869e3fab73df2b1a7062ace46a0f85defea15f75

SHA256
1c8b3621a0f3f4a62f4b4ff5aa63001fc5fafd8de64407c41c2ce3d99b598454

SHA512
0abbc1c819308dfe2401e44af4ddb6984bc26c4b863f91282f79709a1262e185e527f218ac88af9c2e768e548ca2ef302c1cc9f225ed823427c2c5dd175e3c2a

Download Submit
memory/436-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/436-1-0x00000000005A0000-0x00000000005A7000-memory.dmp

Filesize
28KB

Download
memory/436-2-0x00000000005A0000-0x00000000005A7000-memory.dmp

Filesize
28KB

Download
memory/436-3-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/852-18-0x0000000000550000-0x0000000000557000-memory.dmp

Filesize
28KB

Download