2fb3216329599fcf1e9cdef712ae6e57786bccc81f6777bbeec68f12f99976f7

Analysis

max time kernel
110s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afb12cb711e13894ee31784bc6c7a3c0N.exe
Size

280KB
MD5

afb12cb711e13894ee31784bc6c7a3c0
SHA1

e81a3a628193d83dc98179d72035a467cbb8196f
SHA256

2fb3216329599fcf1e9cdef712ae6e57786bccc81f6777bbeec68f12f99976f7
SHA512

ea4ae00e944499301de207018d204e754deb4ee9367038b034f9d12cb86b5cc1997e25f98ec681b0f280e96bbbd209060decbf6ccc7316e1c491a40d01775791
SSDEEP

6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfSi:boSeGUA5YZazpXUmZhZ6SBi

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	afb12cb711e13894ee31784bc6c7a3c0N.exe

Executes dropped EXE 1 IoCs

pid	Process
5024	a1punf5t2of.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe"	afb12cb711e13894ee31784bc6c7a3c0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afb12cb711e13894ee31784bc6c7a3c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1punf5t2of.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 5024	3992	afb12cb711e13894ee31784bc6c7a3c0N.exe	93
PID 3992 wrote to memory of 5024	3992	afb12cb711e13894ee31784bc6c7a3c0N.exe	93
PID 3992 wrote to memory of 5024	3992	afb12cb711e13894ee31784bc6c7a3c0N.exe	93
PID 5024 wrote to memory of 2288	5024	a1punf5t2of.exe	96
PID 5024 wrote to memory of 2288	5024	a1punf5t2of.exe	96
PID 5024 wrote to memory of 2288	5024	a1punf5t2of.exe	96

C:\Users\Admin\AppData\Local\Temp\afb12cb711e13894ee31784bc6c7a3c0N.exe
"C:\Users\Admin\AppData\Local\Temp\afb12cb711e13894ee31784bc6c7a3c0N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
  "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
    "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
    3⤵
    PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Filesize
281KB

MD5
59f906333f3628d5107cd10666769818

SHA1
b429e5d0485c59c792667b94ab669a9c0e2c51ec

SHA256
5feae515a7f536c63096e303b86b366babde5a4995b18fba9e36d2819881d998

SHA512
3d8ee150feaf654b2a7effb4ce2e735745a21dc76d90d4f7887c9215de3b7bb73ca3fda17e43e46c1aec5b24412faa789b851ea24e2b1681276133081e483b72

Download Submit
memory/3992-5-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/3992-22-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/3992-3-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/3992-0-0x00000000753F2000-0x00000000753F3000-memory.dmp

Filesize
4KB

Download
memory/3992-4-0x00000000753F2000-0x00000000753F3000-memory.dmp

Filesize
4KB

Download
memory/3992-6-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/3992-2-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/3992-1-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/3992-7-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/5024-23-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/5024-21-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/5024-24-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/5024-25-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/5024-26-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/5024-28-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads