d7c59c74ba84bfedbbbfe71e60d54ba8bb884396d0d5639c7edba430b1e07c90

Analysis

max time kernel
156s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7c59c74ba84bfedbbbfe71e60d54ba8bb884396d0d5639c7edba430b1e07c90.exe
Size

31KB
MD5

56c4152d715838d3e462657bc89ec371
SHA1

d219c148e958097bb834edfd192f65663d579483
SHA256

d7c59c74ba84bfedbbbfe71e60d54ba8bb884396d0d5639c7edba430b1e07c90
SHA512

00c9a94eee60db4e84f37e31a528709d99df8dae3e42e26d602ffe647e9be017113196e0f24dea579d67d47e4a96878b159b16289741fb8f4c5dcd1c5fe24e73
SSDEEP

768:W67xaGjAer7gy4QMcZJpeBHgf8nR5N7ANTJ7Z2J:Mer8yj3WHJnqNTJ12

Score

9^/10

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 3 IoCs

resource	yara_rule
behavioral2/memory/4460-0-0x0000000000400000-0x0000000000406000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x00020000000227ea-5.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4460-9-0x0000000000400000-0x0000000000406000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	d7c59c74ba84bfedbbbfe71e60d54ba8bb884396d0d5639c7edba430b1e07c90.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	ffengh.exe

Executes dropped EXE 1 IoCs

pid	Process
3632	ffengh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3632	4460	d7c59c74ba84bfedbbbfe71e60d54ba8bb884396d0d5639c7edba430b1e07c90.exe	100
PID 4460 wrote to memory of 3632	4460	d7c59c74ba84bfedbbbfe71e60d54ba8bb884396d0d5639c7edba430b1e07c90.exe	100
PID 4460 wrote to memory of 3632	4460	d7c59c74ba84bfedbbbfe71e60d54ba8bb884396d0d5639c7edba430b1e07c90.exe	100

C:\Users\Admin\AppData\Local\Temp\d7c59c74ba84bfedbbbfe71e60d54ba8bb884396d0d5639c7edba430b1e07c90.exe
"C:\Users\Admin\AppData\Local\Temp\d7c59c74ba84bfedbbbfe71e60d54ba8bb884396d0d5639c7edba430b1e07c90.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\ffengh.exe
  "C:\Users\Admin\AppData\Local\Temp\ffengh.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ffengh.exe

Filesize
31KB

MD5
618752c789b3feca30ec787c98cd68a8

SHA1
020c93ffd1cce593c7ba8b4f4bccb380b468b235

SHA256
54b6ab56317627ecc7233b115a45ed2a13db1f3a08bfec27b784b37cc54fcbdc

SHA512
40ab0224ad44290078579508ae1f2c2536c7f17d941850af3141128331a1fac5fd62de890a2d133c769f43675ac0bf6625541611bae3a755ee74a7106888b927

Download Submit
memory/4460-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4460-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download