5c92f0738c290eac319d4ac3006b5725f1d2163fbfe68dbb2047e07920f4d5e8

Resubmissions

05-03-2024 13:45

240305-q2myfsha98 5

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EnableLoopback.exe
Size

95KB
MD5

5d16400084f534535c922180c562bd70
SHA1

20444c63a2e6ff17a1970f8af0744c0ccfdbb659
SHA256

0ccf6f4b2f6e89ddb50b3075fd6b604ef7c0d6b13ce377781d898dcd8f9c91d7
SHA512

b9dc50aac871ff81c54e000adb1de11c17aeea75fbc80afa5f025d1efe6c79acbfd05b5de6066f084ed0e26d4287c354984195e7aa134545846d371f84063bd0
SSDEEP

768:izEI16zcI2eTcvEWm/ljPjOPAxr25znrSh7A8g3CqnZZ6qmmlGThRR2fTnR2fTT0:y1H5MiP1zrSh7JwZQxmlGKyn6hb

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	EnableLoopback.exe

C:\Users\Admin\AppData\Local\Temp\EnableLoopback.exe
"C:\Users\Admin\AppData\Local\Temp\EnableLoopback.exe"
1⤵
- Checks computer location settings
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:8
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-0-0x0000000000410000-0x0000000000428000-memory.dmp

Filesize
96KB

Download
memory/4796-1-0x00007FFBB7420000-0x00007FFBB7EE1000-memory.dmp

Filesize
10.8MB

Download
memory/4796-2-0x000000001B2F0000-0x000000001B300000-memory.dmp

Filesize
64KB

Download
memory/4796-3-0x000000001B2F0000-0x000000001B300000-memory.dmp

Filesize
64KB

Download
memory/4796-4-0x00007FFBB7420000-0x00007FFBB7EE1000-memory.dmp

Filesize
10.8MB

Download
memory/4796-5-0x000000001B2F0000-0x000000001B300000-memory.dmp

Filesize
64KB

Download
memory/4796-6-0x000000001B2F0000-0x000000001B300000-memory.dmp

Filesize
64KB

Download