3e2fdad51770fac8944f13f388c27fb98663520d33837035287cd00b638f5a55

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e2fdad51770fac8944f13f388c27fb98663520d33837035287cd00b638f5a55.exe
Size

33KB
MD5

86df8f9d75606e0c9e6a260552a2a557
SHA1

97803c8523e51fdc2f7faa03bd64aa679d250291
SHA256

3e2fdad51770fac8944f13f388c27fb98663520d33837035287cd00b638f5a55
SHA512

3f42586d6578852dca2d3f39afdaba432cd9ed368ae3ee3c1d5cabcfba81cf25879172fa0a6742ede2a756b39f0a2564eb102d06a0d6317c379166abe891cf9f
SSDEEP

768:9X+Ht5Gt7Vjmc3JoL9OOg5+6ORE9P4z1QB6STpE:9XjBqRm+6Oe9s1Qo2pE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	3e2fdad51770fac8944f13f388c27fb98663520d33837035287cd00b638f5a55.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1404	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 1404	372	3e2fdad51770fac8944f13f388c27fb98663520d33837035287cd00b638f5a55.exe	99
PID 372 wrote to memory of 1404	372	3e2fdad51770fac8944f13f388c27fb98663520d33837035287cd00b638f5a55.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3e2fdad51770fac8944f13f388c27fb98663520d33837035287cd00b638f5a55.exe
"C:\Users\Admin\AppData\Local\Temp\3e2fdad51770fac8944f13f388c27fb98663520d33837035287cd00b638f5a55.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc hourly /mo 1 /tn "_Task-HOURLY-01" /tr "%MyFile%" /st 00:00
  2⤵
  - Creates scheduled task(s)
  PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/372-0-0x0000000000300000-0x000000000030C000-memory.dmp

Filesize
48KB

Download
memory/372-1-0x00007FFAE92C0000-0x00007FFAE9D81000-memory.dmp

Filesize
10.8MB

Download
memory/372-2-0x00007FFAE92C0000-0x00007FFAE9D81000-memory.dmp

Filesize
10.8MB

Download
memory/372-3-0x000000001C5F0000-0x000000001C600000-memory.dmp

Filesize
64KB

Download
memory/372-4-0x000000001C5F0000-0x000000001C600000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads