1478a5cd68e50813f921db18425f99dfcddaa89c5d683b1420ac530a3026a6c5

Analysis

max time kernel
96s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1478a5cd68e50813f921db18425f99dfcddaa89c5d683b1420ac530a3026a6c5.exe
Size

1.2MB
MD5

0c2e9c8e7a0c754cff93bb572d465b3f
SHA1

e9d16513d744848fd8973a915619306c80c4b27a
SHA256

1478a5cd68e50813f921db18425f99dfcddaa89c5d683b1420ac530a3026a6c5
SHA512

566843c0d7385aa70c25ea2cef398b6ce2885121dcd5c9e4c4c92cc640ffb4fff86962a697ce3675c4096b179d3971e65fbd562e7a6cdfe81dd536f96b9eac12
SSDEEP

24576:dMs8x56hd8BiPp/0+1Mrjs6mZ/F7qXh0lhSMXl/YJ4Ad4:+s8b6hmBipRMrjMJ1q2PEa

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	1478a5cd68e50813f921db18425f99dfcddaa89c5d683b1420ac530a3026a6c5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	1478a5cd68e50813f921db18425f99dfcddaa89c5d683b1420ac530a3026a6c5.exe
Token: SeImpersonatePrivilege	2756	1478a5cd68e50813f921db18425f99dfcddaa89c5d683b1420ac530a3026a6c5.exe

C:\Users\Admin\AppData\Local\Temp\1478a5cd68e50813f921db18425f99dfcddaa89c5d683b1420ac530a3026a6c5.exe
"C:\Users\Admin\AppData\Local\Temp\1478a5cd68e50813f921db18425f99dfcddaa89c5d683b1420ac530a3026a6c5.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads