a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff

Analysis

max time kernel
94s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe
Size

2.2MB
MD5

c1d9f60cd95a73f8e44ea94e3aa7c0a4
SHA1

13ea3d0220f3a61b210731ed65e99a86d0757f4c
SHA256

a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff
SHA512

b4dc9eacf095f3eb07e08cc782a99009e0be438f24ca79e53d8da727bfec20fbf8050e22382fb9ad44c02d956fb35447fdc5a90da46d18a71d8fa9ebecdf3f50
SSDEEP

24576:VnV20g3y1Nu/hZ99HKG354VTH62rtJNxlf/8D9+qNgzQJWDqVT86sSvPi9tuyU:uWohZTKi49Bff/1QQDqrsSiru

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe
Token: SeImpersonatePrivilege	1448	a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe

C:\Users\Admin\AppData\Local\Temp\a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe
"C:\Users\Admin\AppData\Local\Temp\a91d9f566a433a99e842f33931932c66b86f8c5b74b4322484e54acaa06a2cff.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-0-0x00007FF668A50000-0x00007FF668A51000-memory.dmp

Filesize
4KB

Download
memory/1448-4-0x00007FF6E89C1000-0x00007FF6E89C2000-memory.dmp

Filesize
4KB

Download
memory/1448-5-0x00007FF6E8960000-0x00007FF6E8BA0000-memory.dmp

Filesize
2.2MB

Download
memory/1448-8-0x00007FF6E8960000-0x00007FF6E8BA0000-memory.dmp

Filesize
2.2MB

Download