a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae

Analysis

max time kernel
154s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe
Size

32KB
MD5

f4e6103df47a435c1084d88e335f3076
SHA1

0b020accbdf46f96fab024d92eaca4a1d6e9eeee
SHA256

a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae
SHA512

fbcef1bd6f4499ded28cb1b2738f9f9deddea9661e00809eb9fc47c05bb25fd6df29628bc06e423dc06773d61d2d9d9dc9c98938cf8b1d1b8cef0509e9d0992c
SSDEEP

384:oPDUQ/pgeUkI74UHCsD2GAYIPHbABKwSU3Fexbzm+4VWuMGY:+l/43MUHB2XtvbA8QO6+SWgY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe

Executes dropped EXE 1 IoCs

pid	Process
3708	gffos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 3708	1120	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe	88
PID 1120 wrote to memory of 3708	1120	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe	88
PID 1120 wrote to memory of 3708	1120	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe	88

C:\Users\Admin\AppData\Local\Temp\a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe
"C:\Users\Admin\AppData\Local\Temp\a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\gffos.exe
  "C:\Users\Admin\AppData\Local\Temp\gffos.exe"
  2⤵
  - Executes dropped EXE
  PID:3708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gffos.exe

Filesize
32KB

MD5
5b77cb155d7c375ae29610dbddfb5ec5

SHA1
750a01c22a6d2af576fac9ceb2957424260754f3

SHA256
af489ae381873d952ddff56e50724acb97aeffc22f1a4f0f32d4caf5cf610efd

SHA512
48e5a0ea4e31670bb4596d4345620e7c3922e475bc3e0f7d30674c8ba63dbbbe1fdd4e22c780cf38d8b90aa8252522e2770793b8eeb6071de4abb7822aeb628d

Download Submit
memory/1120-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1120-1-0x0000000002010000-0x0000000002018000-memory.dmp

Filesize
32KB

Download
memory/1120-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3708-22-0x00000000004A0000-0x00000000004A8000-memory.dmp

Filesize
32KB

Download