af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2

General

Target

af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2.exe
Size

278KB
MD5

82b23194fa2793c270c8297dfe95f27c
SHA1

056022b0ca3904ef238287d359dad6f5bb76edd8
SHA256

af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2
SHA512

b7c4b84cdfdfd651c6c4e20229a84c379094dbd461c7bf0d6d5ccacec0f7ef6051cc9263b290ba7db59ff566a5d9699fe14242e047abc72c81c749205a9e536e
SSDEEP

6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fp:boSeGUA5YZazpXUmZhZ6R

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2.exe

Executes dropped EXE 1 IoCs

pid	Process
1924	a1punf5t2of.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe"	af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1punf5t2of.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1924	1328	af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2.exe	91
PID 1328 wrote to memory of 1924	1328	af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2.exe	91
PID 1328 wrote to memory of 1924	1328	af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2.exe	91
PID 1924 wrote to memory of 904	1924	a1punf5t2of.exe	97
PID 1924 wrote to memory of 904	1924	a1punf5t2of.exe	97
PID 1924 wrote to memory of 904	1924	a1punf5t2of.exe	97

C:\Users\Admin\AppData\Local\Temp\af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2.exe
"C:\Users\Admin\AppData\Local\Temp\af3982488f54fc331e04f244ed0ca403259e37a72009148471564f9237f3a7b2.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
  "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
    "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
    3⤵
    PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
1⤵
PID:616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Filesize
278KB

MD5
88b6813654b4a3cd0d8bb32784cbbd72

SHA1
41eb501ca5bcc41f055d6c09bcdf78e20627eb40

SHA256
daa5c5edbd61f346d74a73e4a11e28b71764515296fd2094c9889de810144a72

SHA512
4b39deb7e56c70dcd38c5a4a5be1574d0c74a442665cd5b55be7163d30b21f4a076be90f7da5783f7ad4bc792140473e4715d649354129a58d9694e317e373fc

Download Submit
memory/1328-4-0x0000000074732000-0x0000000074733000-memory.dmp

Filesize
4KB

Download
memory/1328-22-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1328-3-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1328-0-0x0000000074732000-0x0000000074733000-memory.dmp

Filesize
4KB

Download
memory/1328-5-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1328-6-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1328-2-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1328-7-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1328-1-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1924-21-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1924-23-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1924-24-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1924-25-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1924-26-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1924-27-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download
memory/1924-29-0x0000000074730000-0x0000000074CE1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads