14b7a03d84327c9e96c04cc58bea94508ca22b159d1936042fa10fccf821f392

Analysis

max time kernel
101s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14b7a03d84327c9e96c04cc58bea94508ca22b159d1936042fa10fccf821f392N.exe
Size

49KB
MD5

07672f1344bde6d096178f80ae0e0910
SHA1

e8804027b8bf05827d1367e4b9dfac6500445606
SHA256

14b7a03d84327c9e96c04cc58bea94508ca22b159d1936042fa10fccf821f392
SHA512

f41788abd422d9864bdb77b535b7cb062a7dc66937a769797a63d022420a54b0d04fb27a91fb14a5951e0335ed935ef94bd5d94300060aa6b01e5f957a551d0c
SSDEEP

192:k/bjPXYrArrDcLpEZc5ozqRgj8mVnnlYJLKu3LT52hEuViBES:kaLpES6zqGjrOOu3LTYhOE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	14b7a03d84327c9e96c04cc58bea94508ca22b159d1936042fa10fccf821f392N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 1108	3208	14b7a03d84327c9e96c04cc58bea94508ca22b159d1936042fa10fccf821f392N.exe	91
PID 3208 wrote to memory of 1108	3208	14b7a03d84327c9e96c04cc58bea94508ca22b159d1936042fa10fccf821f392N.exe	91

C:\Users\Admin\AppData\Local\Temp\14b7a03d84327c9e96c04cc58bea94508ca22b159d1936042fa10fccf821f392N.exe
"C:\Users\Admin\AppData\Local\Temp\14b7a03d84327c9e96c04cc58bea94508ca22b159d1936042fa10fccf821f392N.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start.bat" "
  2⤵
  PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\start.bat

Filesize
14B

MD5
92a6f2af2e2bf7d6e64b7821f5400d1c

SHA1
ee3e35bf31da9e6616c1c6a663fd19b4d745a279

SHA256
89b15dd343075c7271ec08f848803709a915526e81831af0a9df53577b5155b5

SHA512
57ebb186b961d2e73bfe554f247b53558cd358bba5716578c355a85caf783087495ca15e981bed2c049e4485bb3d5edf413d90b0e16f68ba95bbdc7f26f5b29f

Download Submit
memory/3208-0-0x00007FFA1CC83000-0x00007FFA1CC85000-memory.dmp

Filesize
8KB

Download
memory/3208-1-0x0000000000AB0000-0x0000000000AB6000-memory.dmp

Filesize
24KB

Download
memory/3208-6-0x00007FFA1CC80000-0x00007FFA1D741000-memory.dmp

Filesize
10.8MB

Download
memory/3208-7-0x00007FFA1CC80000-0x00007FFA1D741000-memory.dmp

Filesize
10.8MB

Download