f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b

Analysis

max time kernel
128s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b.exe
Size

20KB
MD5

abeec6065e144c428718311610f6798e
SHA1

4da90dc9055034789f2c1747bc107188ada293ca
SHA256

f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b
SHA512

907a2e56cf8c1fe9c8a06855f5208744f3bc3509e24467eac2d4c4f5fbbab76fadbdbf383d670d1b89bc3771ccd6faafeb1c76722347672efedb07a6b9414e20
SSDEEP

384:SjIAaIbL6kbkxRIyel11RlPOBJrXXfif3Y97H9:Ss9IJAxRIy++rXXfq+9

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

foxupdater.exe

pid process

2348 foxupdater.exe

pid	process
2348	foxupdater.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b.exe

description	pid	process	target process
PID 3704 wrote to memory of 2348	3704	f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b.exe	foxupdater.exe
PID 3704 wrote to memory of 2348	3704	f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b.exe	foxupdater.exe
PID 3704 wrote to memory of 2348	3704	f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b.exe	foxupdater.exe

C:\Users\Admin\AppData\Local\Temp\f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b.exe
"C:\Users\Admin\AppData\Local\Temp\f4330ede106b5c29787d15767163a0f3dd751c3382204d2369efc71116cad46b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\foxupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\foxupdater.exe"
  2⤵
  - Executes dropped EXE
  PID:2348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\foxupdater.exe

Filesize
21KB

MD5
f1812546094c8c0dae574bf2435be73a

SHA1
c587d7167d960d82dc21c3958cff42813d9f3aba

SHA256
548b73cc2af4f3417dcdeb7251407cf162af1e63664fe7bf07debeaf8de27886

SHA512
7be2162058e860e62e3c78b1484fd7415d0ec3516fb6f7f8ce8114fad6d11f85504e3f6d8e701b9a5ed46de8c637c3e7a69b484116265f9b05a9344c64dda3dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\foxupdater.exe

Filesize
21KB

MD5
f1812546094c8c0dae574bf2435be73a

SHA1
c587d7167d960d82dc21c3958cff42813d9f3aba

SHA256
548b73cc2af4f3417dcdeb7251407cf162af1e63664fe7bf07debeaf8de27886

SHA512
7be2162058e860e62e3c78b1484fd7415d0ec3516fb6f7f8ce8114fad6d11f85504e3f6d8e701b9a5ed46de8c637c3e7a69b484116265f9b05a9344c64dda3dd

Download Submit
memory/2348-132-0x0000000000000000-mapping.dmp

Download