Analysis
-
max time kernel
154s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 23:01
Static task
static1
Behavioral task
behavioral1
Sample
a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe
Resource
win10v2004-20240226-en
General
-
Target
a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe
-
Size
32KB
-
MD5
f4e6103df47a435c1084d88e335f3076
-
SHA1
0b020accbdf46f96fab024d92eaca4a1d6e9eeee
-
SHA256
a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae
-
SHA512
fbcef1bd6f4499ded28cb1b2738f9f9deddea9661e00809eb9fc47c05bb25fd6df29628bc06e423dc06773d61d2d9d9dc9c98938cf8b1d1b8cef0509e9d0992c
-
SSDEEP
384:oPDUQ/pgeUkI74UHCsD2GAYIPHbABKwSU3Fexbzm+4VWuMGY:+l/43MUHB2XtvbA8QO6+SWgY
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe -
Executes dropped EXE 1 IoCs
pid Process 3708 gffos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1120 wrote to memory of 3708 1120 a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe 88 PID 1120 wrote to memory of 3708 1120 a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe 88 PID 1120 wrote to memory of 3708 1120 a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe"C:\Users\Admin\AppData\Local\Temp\a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\gffos.exe"C:\Users\Admin\AppData\Local\Temp\gffos.exe"2⤵
- Executes dropped EXE
PID:3708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD55b77cb155d7c375ae29610dbddfb5ec5
SHA1750a01c22a6d2af576fac9ceb2957424260754f3
SHA256af489ae381873d952ddff56e50724acb97aeffc22f1a4f0f32d4caf5cf610efd
SHA51248e5a0ea4e31670bb4596d4345620e7c3922e475bc3e0f7d30674c8ba63dbbbe1fdd4e22c780cf38d8b90aa8252522e2770793b8eeb6071de4abb7822aeb628d