3826ee4739fae4efb4c4b3177ed57ce4b52b9711bdd7fcb089f26fda22d7d2a9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3826ee4739fae4efb4c4b3177ed57ce4b52b9711bdd7fcb089f26fda22d7d2a9.exe
Size

41KB
MD5

40c6a18bfae679c9d25e9d960e9c9e83
SHA1

fa462166aa17623ba9416864e2e125960e8b7345
SHA256

3826ee4739fae4efb4c4b3177ed57ce4b52b9711bdd7fcb089f26fda22d7d2a9
SHA512

9030520ca2b7d9331675563a19049b20fe2ccdc5be5f5414f45b0783d91532eac97cac4b58725ebfa19a98dab5f56ae28a01232533b1d715b65b65f3c8f88a5e
SSDEEP

384:AQWRRIWCwovIVhraM7WT4EOyyA87fZHg8FKVN1ICrL:AhRyvm7oOyyA87fdICcL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	3826ee4739fae4efb4c4b3177ed57ce4b52b9711bdd7fcb089f26fda22d7d2a9.exe

Executes dropped EXE 1 IoCs

pid	Process
3788	updGA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3788	2668	3826ee4739fae4efb4c4b3177ed57ce4b52b9711bdd7fcb089f26fda22d7d2a9.exe	95
PID 2668 wrote to memory of 3788	2668	3826ee4739fae4efb4c4b3177ed57ce4b52b9711bdd7fcb089f26fda22d7d2a9.exe	95
PID 2668 wrote to memory of 3788	2668	3826ee4739fae4efb4c4b3177ed57ce4b52b9711bdd7fcb089f26fda22d7d2a9.exe	95

C:\Users\Admin\AppData\Local\Temp\3826ee4739fae4efb4c4b3177ed57ce4b52b9711bdd7fcb089f26fda22d7d2a9.exe
"C:\Users\Admin\AppData\Local\Temp\3826ee4739fae4efb4c4b3177ed57ce4b52b9711bdd7fcb089f26fda22d7d2a9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\updGA.exe
  "C:\Users\Admin\AppData\Local\Temp\updGA.exe"
  2⤵
  - Executes dropped EXE
  PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:8
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\updGA.exe

Filesize
41KB

MD5
daaeb3986ade9214693238d6d197334b

SHA1
6897abb957c1ab4532caa9644da8a4f746ce9f43

SHA256
591289ef5863214388d4ac7b8554a9dde68e03c554a623249472dabfa9a66522

SHA512
fd173a511b99d036acaeb0079c208b467a5c6e2156b21838cc4d662f40b964a33bca6e7194e9904dab5e82577aa7663866bfe993e290907de7a32e5126643723

Download Submit