c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3

Analysis

max time kernel
21s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe
Size

84KB
MD5

92f03bdeba91e719ce9a81dc18ddda10
SHA1

471ce1bd129991c37b32394dae1217d3b5ff93ea
SHA256

c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3
SHA512

bb41008d21ef6bceb50ed94da08e2b5722d9a7e9d498fe6dc17328ca5252fe1cc6f558735d4cff0402d5b70caed58cd286f22949fe423b25fca77bdba288ad88
SSDEEP

1536:IGsBuoFn7UZ+LtdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsbI8zq:IGjot7UQLtdgI2MyzNORQtOflIwoHNVt

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe

Executes dropped EXE 1 IoCs

Processes:

kgfdfjdk.exe

pid process

4436 kgfdfjdk.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4436	kgfdfjdk.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe

description	pid	process	target process
PID 3560 wrote to memory of 4436	3560	c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe	kgfdfjdk.exe
PID 3560 wrote to memory of 4436	3560	c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe	kgfdfjdk.exe
PID 3560 wrote to memory of 4436	3560	c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe	kgfdfjdk.exe

C:\Users\Admin\AppData\Local\Temp\c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe
"C:\Users\Admin\AppData\Local\Temp\c7a4a3d6a33ff2999f26c7721c84267137196479abbbb161de5d360fa3f64bc3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3560

C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe
"C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe"
2⤵
- Executes dropped EXE
PID:4436

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe
Filesize
84KB

MD5
9228628d4fac960e3edcfa86148d8ea7

SHA1
1898b315b346462c456b3c9d9f2c2b921a579ec6

SHA256
05baf647a0ae90143603508eebe337f0c97482ae8310dbb9243870b76adcc7e4

SHA512
924ee05966ae9b47af0871710b32cf3cf6a00f7659404b6a1ad7ec7d68c354c8c4cc8e7009b4337871edd1793702869d7fa67be7243ddb560df0d81d66c39177

Download Submit
memory/3560-0-0x0000000003500000-0x0000000003516000-memory.dmp

Filesize
88KB

Download
memory/3560-2-0x0000000002030000-0x0000000002035000-memory.dmp

Filesize
20KB

Download
memory/3560-10-0x0000000003500000-0x0000000003516000-memory.dmp

Filesize
88KB

Download
memory/4436-12-0x0000000000590000-0x0000000000595000-memory.dmp

Filesize
20KB

Download
memory/4436-11-0x0000000003500000-0x0000000003516000-memory.dmp

Filesize
88KB

Download
memory/4436-13-0x0000000003500000-0x0000000003516000-memory.dmp

Filesize
88KB

Download