e7fb2b7e714f4bc6245ae6ded64c74294e819a3569247a2e361d07ed310a578b

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7fb2b7e714f4bc6245ae6ded64c74294e819a3569247a2e361d07ed310a578bN.exe
Size

43KB
MD5

3326a87faeb8c2087f4988d390e5b230
SHA1

878a77cc2b96627ac2a4b4a31d6a80b35ba4454c
SHA256

e7fb2b7e714f4bc6245ae6ded64c74294e819a3569247a2e361d07ed310a578b
SHA512

28c353e6fd1b7656d7ea5c0b0a42bcf14952b390403884539b126d96d65b85c560b5e38bdf0b3365c1c3983d36123a782744d0b6fc61995070f634f6d2102583
SSDEEP

768:swg9aYfQkXdmCdMimsENm4QctL4yM2F4hUmQe:sR0QQwndcsE0vSMXzQe

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	e7fb2b7e714f4bc6245ae6ded64c74294e819a3569247a2e361d07ed310a578bN.exe

Executes dropped EXE 1 IoCs

pid	Process
3856	hhcbrnaff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7fb2b7e714f4bc6245ae6ded64c74294e819a3569247a2e361d07ed310a578bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hhcbrnaff.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3856	3916	e7fb2b7e714f4bc6245ae6ded64c74294e819a3569247a2e361d07ed310a578bN.exe	82
PID 3916 wrote to memory of 3856	3916	e7fb2b7e714f4bc6245ae6ded64c74294e819a3569247a2e361d07ed310a578bN.exe	82
PID 3916 wrote to memory of 3856	3916	e7fb2b7e714f4bc6245ae6ded64c74294e819a3569247a2e361d07ed310a578bN.exe	82

C:\Users\Admin\AppData\Local\Temp\e7fb2b7e714f4bc6245ae6ded64c74294e819a3569247a2e361d07ed310a578bN.exe
"C:\Users\Admin\AppData\Local\Temp\e7fb2b7e714f4bc6245ae6ded64c74294e819a3569247a2e361d07ed310a578bN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe
  "C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

Filesize
43KB

MD5
0f43adaeafcca931791cb9ad5601d8fe

SHA1
0dfd74ad160bf7c60e186db6d7aa6eaeaa156c8c

SHA256
02aa6bf664df4d1d36d3e5a57fb76832e09fc21194154c31e8b5bd8794e2d6f6

SHA512
db879f5379c12b8e30b6f64f2da1ad3879df1a2db5d5ccc1b5ab29015cc24bddb70c4185848d057e49aa049378d1908ae54f38d6962183c1055f1d8e01d81a3f

Download Submit
memory/3856-14-0x00000000026F0000-0x0000000002AF0000-memory.dmp

Filesize
4.0MB

Download
memory/3856-13-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/3856-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3916-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3916-1-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/3916-3-0x0000000002710000-0x0000000002B10000-memory.dmp

Filesize
4.0MB

Download
memory/3916-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download