adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8

Analysis

max time kernel
94s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2024 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe
Size

155KB
MD5

91b007423dd441899daee35f6beb1d00
SHA1

e69066fc5f71efdace9ce2bfd14a6c7154141562
SHA256

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8
SHA512

72a236248d283667b59063012ed7067d3733986907492ca8a12d1fda7a53b8bbc073640b22516a6f288afc723209bc6fcb6d5225488dad08f49d1d0b3de1f44f
SSDEEP

3072:Ntbqvi9nMKxQbZ5x66EfACsxfcYvQd2Oe3:Nt2vsx+AV4LfLOi

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

4924 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4924	biudfw.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exebiudfw.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe

description	pid	process	target process
PID 2836 wrote to memory of 4924	2836	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	biudfw.exe
PID 2836 wrote to memory of 4924	2836	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	biudfw.exe
PID 2836 wrote to memory of 4924	2836	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	biudfw.exe
PID 2836 wrote to memory of 320	2836	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	cmd.exe
PID 2836 wrote to memory of 320	2836	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	cmd.exe
PID 2836 wrote to memory of 320	2836	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe
"C:\Users\Admin\AppData\Local\Temp\adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
155KB

MD5
b7822b716ec2baa552fdc1be65e74e22

SHA1
50996ca049c9ad8d61e8f48878888e54dadbefdc

SHA256
6cf2633c6e59c76e84a3efba0100893a4929768bede21c184ea81da0ec5ee654

SHA512
eacd80772c2e497b8c522f8abef17ce03645a88605d77cfea794d70201e5499e235eb92ae3d80e66bfbd08a623831304a82868c46f9c8a780d17589669e3b52c

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
2930c042c9ee5e07f321f2134a0c7edc

SHA1
ee39f41eaf6ce3c8d917a89e65959414ae0088e6

SHA256
a328475bbb730da292b83ed6cabbdbfc0616f042296f0c6fa356c5368ffc1309

SHA512
2da91d5effc116d8c8661c2a99f1d9c2aaffda0f776551dc7ad1911fdb2765591e5b441b9a1fe0090bcda8ed24d180b563ed2c127676cf1de40001e4b15b5506

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
ae52a6d1c87e1427d3c685a79d95d16d

SHA1
5f8867cf454d76c245f386c312764f8242ff0b61

SHA256
1b84d32bf2f70071e80700e0a0531aa9cc1bb3bb92a24c83ba8b9ac9d49e9994

SHA512
d86060cdfa005a1b11625fdee16d246036d2ccfe3913b0b59dec14ec1b9e9d88459a070a33743092ba0cd47d0b57039f73d07b6d0e120d35300ab9cc8347fccc

Download Submit