ad3945caaaf96d4b7020f0776cbad16b98a422ca8fa8fa97240cf1c67f408f56

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb9bf3b1f77c6c9f23ee3937d9ab7cb9.exe
Size

47KB
MD5

cb9bf3b1f77c6c9f23ee3937d9ab7cb9
SHA1

572bdadc3c10b233eac2914cd90e48423a0e199e
SHA256

ad3945caaaf96d4b7020f0776cbad16b98a422ca8fa8fa97240cf1c67f408f56
SHA512

e70156b950e40685e396fbe450b990d6aad85f53402be1ff324d6160b897ca2c131c81f940cdbd623895fdd16831748d7abf99353a2af8200f418b70dca9e71b
SSDEEP

768:aPuHTcUmgsRgsbnkdXZ390+CmJc/LjwbqonYFLnAtqozjLHdHlH:MuHTc0sRnbkdXZ3zdc/gBnTnL95

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cb9bf3b1f77c6c9f23ee3937d9ab7cb9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\cb9bf3b1f77c6c9f23ee3937d9ab7cb9.exe
"C:\Users\Admin\AppData\Local\Temp\cb9bf3b1f77c6c9f23ee3937d9ab7cb9.exe"
1⤵
- Checks computer location settings
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\plugs\mmc248.exe

Filesize
47B

MD5
2079de86c2f563b129b99bacca34ac23

SHA1
9cd346283354dbae0118488be07b73e6a9292a1a

SHA256
57e5a4c140bcc8738d1daa3f6cee05aac052218d286f69e4f4303fbc8af19ea7

SHA512
946e89de4a2df78bc3952bb79843c95b137e0494ffba3e0b956aa1073beaf759d14fed9ea033adc2cee1aa8cc272b5a8ea6e23ae74caaf196ff73b555466706a

Download Submit
memory/3852-0-0x00000000005B0000-0x00000000005BF000-memory.dmp

Filesize
60KB

Download
memory/3852-1-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3852-2-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3852-43-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3852-64-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3852-102-0x00000000005B0000-0x00000000005BF000-memory.dmp

Filesize
60KB

Download