7e5ae873aacfd161eadcce77995e83ce3da69baa4bfa70f6c502d3b6fb9d0a8d

Analysis

max time kernel
90s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e5ae873aacfd161eadcce77995e83ce3da69baa4bfa70f6c502d3b6fb9d0a8d.exe
Size

23KB
MD5

f4afc1da091113750304de62ea7c49ae
SHA1

3e9bc4c014df75e3020e0f6ad70486bf6d552ee6
SHA256

7e5ae873aacfd161eadcce77995e83ce3da69baa4bfa70f6c502d3b6fb9d0a8d
SHA512

9884232b680f05a20b5595b9a729d95c17dbe31ffb662df6073b63d16884ad74c0dee5172ff6cdc7072dc9434be123947639c379e47e1de7c8570214d3f19936
SSDEEP

384:YpIT5mv2W8EfxKOx0hyWQ9Xc0TSj50ZLuKHu52ifdL:Y85mv2WHEOx0hyWQIULuKO5zdL

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	7e5ae873aacfd161eadcce77995e83ce3da69baa4bfa70f6c502d3b6fb9d0a8d.exe

Executes dropped EXE 1 IoCs

pid	Process
2752	zuty.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e5ae873aacfd161eadcce77995e83ce3da69baa4bfa70f6c502d3b6fb9d0a8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuty.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2752	4916	7e5ae873aacfd161eadcce77995e83ce3da69baa4bfa70f6c502d3b6fb9d0a8d.exe	83
PID 4916 wrote to memory of 2752	4916	7e5ae873aacfd161eadcce77995e83ce3da69baa4bfa70f6c502d3b6fb9d0a8d.exe	83
PID 4916 wrote to memory of 2752	4916	7e5ae873aacfd161eadcce77995e83ce3da69baa4bfa70f6c502d3b6fb9d0a8d.exe	83

C:\Users\Admin\AppData\Local\Temp\7e5ae873aacfd161eadcce77995e83ce3da69baa4bfa70f6c502d3b6fb9d0a8d.exe
"C:\Users\Admin\AppData\Local\Temp\7e5ae873aacfd161eadcce77995e83ce3da69baa4bfa70f6c502d3b6fb9d0a8d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\zuty.exe
  "C:\Users\Admin\AppData\Local\Temp\zuty.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zuty.exe

Filesize
23KB

MD5
7efe0da0afc69177f91c6b4f32eb6def

SHA1
34ffd3c993c1d19a356df30d8a6b691a5a80df44

SHA256
404169ef06aad515da7930c3ef821eba744d8f2d2eb48a0f903be61c4914a954

SHA512
c7b69487659787fb4c9ad05d80bc837d05902b2e2d685aa1fc8f852c94835061dad04cc3a302a8fbe5a17ae6b3a143ca6a22cbce3f5d5b7c3f1a4c507ef527b5

Download Submit
memory/2752-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4916-0-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download