c1cf11f6a8b726d072216b98d4feb2b12e73b17f2f64253b0ee761b8365f97df

Analysis

max time kernel
96s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1cf11f6a8b726d072216b98d4feb2b12e73b17f2f64253b0ee761b8365f97dfN.exe
Size

130KB
MD5

e99bd9be832a4f467974459da47099e0
SHA1

fc38974ecc3de8d75bb61eac78c5082ca80bc706
SHA256

c1cf11f6a8b726d072216b98d4feb2b12e73b17f2f64253b0ee761b8365f97df
SHA512

09667aa01933b411c75a205d1783b92ac7e2a4bd3c0394950e34d4306713577c7aed88f88ab8af8a07a44a6c2580b9460c25319e5d58d082ef7f28dc0c2357ee
SSDEEP

3072:kcjjuSrGn/x4+e7gyUvOvR0BZNnvRF0oHoGJW+kXfdPC7ho0rSzJ6V30qD+:kcjjuSrGn/x4+e7PUvOvR0BZNnv30oHI

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	c1cf11f6a8b726d072216b98d4feb2b12e73b17f2f64253b0ee761b8365f97dfN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1cf11f6a8b726d072216b98d4feb2b12e73b17f2f64253b0ee761b8365f97dfN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 5036	1856	c1cf11f6a8b726d072216b98d4feb2b12e73b17f2f64253b0ee761b8365f97dfN.exe	82
PID 1856 wrote to memory of 5036	1856	c1cf11f6a8b726d072216b98d4feb2b12e73b17f2f64253b0ee761b8365f97dfN.exe	82
PID 1856 wrote to memory of 5036	1856	c1cf11f6a8b726d072216b98d4feb2b12e73b17f2f64253b0ee761b8365f97dfN.exe	82

C:\Users\Admin\AppData\Local\Temp\c1cf11f6a8b726d072216b98d4feb2b12e73b17f2f64253b0ee761b8365f97dfN.exe
"C:\Users\Admin\AppData\Local\Temp\c1cf11f6a8b726d072216b98d4feb2b12e73b17f2f64253b0ee761b8365f97dfN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Znv..bat" > nul 2> nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Znv..bat

Filesize
276B

MD5
e29711b5bd53a60af0c8118bfbb02e97

SHA1
f19765e075aac04093f0490bc48462b8472b749e

SHA256
908e5900013511bd0e76d64d20df0928c1c231825dd438f2faee66cb219aa00a

SHA512
c40d8a6212924ec1e182c834fe160706927222f630d09644f5558f484937e9f73f2e299b478f138978d6b6e56c197a912ae31d760734266e05151309a6705d75

Download Submit
memory/1856-0-0x000000000040A000-0x000000000040C000-memory.dmp

Filesize
8KB

Download
memory/1856-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1856-2-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1856-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1856-4-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1856-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download