f30ea0f7276100d02319bee64445888af5d784eb12a962ea88f99d2ae4137897

Analysis

max time kernel
91s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MicrosoftWindowsServicesEtc/Major.exe
Size 60KB
Sample240302-3d17dsag33
SHA256 da0233f5e5e9a34e8dd4f6911444ca1f3e29bb9cbd958a9f4508ac7d72ccd55d
MD5 d604c29940864c64b4752d31e2deb465
SHA1 c1698ea4e5d1ba1c9b78973556f97e8f6dbbdef3
SHA512 89a4a14574ba19fe319c766add0111feeb4320c08bf75f55a898d9acc783d5a862a6433758a413cc719b9179dcf873f1c850d1084851b8fc37aa1e3deabfcf54
SSDEEP 768:jfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQ/:4IxKWLvFn43bovQtu7qo43jjRDf4h/q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Major.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 3792	1576	Major.exe	91
PID 1576 wrote to memory of 3792	1576	Major.exe	91

C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\Major.exe
"C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\Major.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\3C5D.tmp\3C5E.vbs
  2⤵
  PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3C5E.vbs

Path C:\Users\Admin\AppData\Local\Temp\3C5D.tmp\3C5E.vbs
Size 2KB
SHA256 cbd3b0f294e8f11592a3ad80d1070d81746f806a48183b93c345251422ccbf0d
MD5 9192fd494155eab424110765c751559e
SHA1 b54fcc1e29617b3eee1c7bb215c048498881b641
SHA512 b8c48916535f3721e7f47be6af671765c3befefcd407c6ea5fabcf9ada119747408d662f61fb436f98a7c33050b6674da54dddf25e683429204a96555ec6e801
MD5 SHA1 SHA512

Submit Download