adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe
Size

155KB
MD5

91b007423dd441899daee35f6beb1d00
SHA1

e69066fc5f71efdace9ce2bfd14a6c7154141562
SHA256

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8
SHA512

72a236248d283667b59063012ed7067d3733986907492ca8a12d1fda7a53b8bbc073640b22516a6f288afc723209bc6fcb6d5225488dad08f49d1d0b3de1f44f
SSDEEP

3072:Ntbqvi9nMKxQbZ5x66EfACsxfcYvQd2Oe3:Nt2vsx+AV4LfLOi

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe

Executes dropped EXE 1 IoCs

pid	Process
3788	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 3788	3520	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	89
PID 3520 wrote to memory of 3788	3520	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	89
PID 3520 wrote to memory of 3788	3520	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	89
PID 3520 wrote to memory of 2996	3520	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	90
PID 3520 wrote to memory of 2996	3520	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	90
PID 3520 wrote to memory of 2996	3520	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	90

C:\Users\Admin\AppData\Local\Temp\adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe
"C:\Users\Admin\AppData\Local\Temp\adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
155KB

MD5
4e72b8f4b92e61b1ec51d37af58f30f7

SHA1
d9babc204a73b5471ac1505e743cb002e7aaa10d

SHA256
3396e236332d7c506ebeb09cad64a6e4b33bf4a2299c4a25be900a5c37714d91

SHA512
1c320d2e937b12f530bd9ed4ee8bd6da19da41c64985f7205435c74502143c94298ce57b050b65504bac52c89b0d4e9ad70d23a804c7276d139b219adfa3f920

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
2930c042c9ee5e07f321f2134a0c7edc

SHA1
ee39f41eaf6ce3c8d917a89e65959414ae0088e6

SHA256
a328475bbb730da292b83ed6cabbdbfc0616f042296f0c6fa356c5368ffc1309

SHA512
2da91d5effc116d8c8661c2a99f1d9c2aaffda0f776551dc7ad1911fdb2765591e5b441b9a1fe0090bcda8ed24d180b563ed2c127676cf1de40001e4b15b5506

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
ae52a6d1c87e1427d3c685a79d95d16d

SHA1
5f8867cf454d76c245f386c312764f8242ff0b61

SHA256
1b84d32bf2f70071e80700e0a0531aa9cc1bb3bb92a24c83ba8b9ac9d49e9994

SHA512
d86060cdfa005a1b11625fdee16d246036d2ccfe3913b0b59dec14ec1b9e9d88459a070a33743092ba0cd47d0b57039f73d07b6d0e120d35300ab9cc8347fccc

Download Submit