c04266de4c2c149da0719d87fe6a5d4e820a4b0c05d130292442b93f7d755c72

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c04266de4c2c149da0719d87fe6a5d4e820a4b0c05d130292442b93f7d755c72.exe
Size

37KB
MD5

185319b3b283b358fd9cbab2a4ad7e03
SHA1

4aac15103dc26079f2bf464b62a1e0f02033797a
SHA256

c04266de4c2c149da0719d87fe6a5d4e820a4b0c05d130292442b93f7d755c72
SHA512

75451185c849e59df72407856e003f3f15cc824e80ce1f000ec433d67bab5c1d6433cfca73cfe52f293a4710a1e73063dae154ae313f61c0036f6eed8cec81c1
SSDEEP

768:pdA4TOKjHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8tvCkA8SsBiaojlbAwif:nA4TljXRrs9sINeZEtejlIkoLN127BFX

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	c04266de4c2c149da0719d87fe6a5d4e820a4b0c05d130292442b93f7d755c72.exe

Executes dropped EXE 1 IoCs

pid	Process
392	update_Firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 392	4032	c04266de4c2c149da0719d87fe6a5d4e820a4b0c05d130292442b93f7d755c72.exe	84
PID 4032 wrote to memory of 392	4032	c04266de4c2c149da0719d87fe6a5d4e820a4b0c05d130292442b93f7d755c72.exe	84
PID 4032 wrote to memory of 392	4032	c04266de4c2c149da0719d87fe6a5d4e820a4b0c05d130292442b93f7d755c72.exe	84

C:\Users\Admin\AppData\Local\Temp\c04266de4c2c149da0719d87fe6a5d4e820a4b0c05d130292442b93f7d755c72.exe
"C:\Users\Admin\AppData\Local\Temp\c04266de4c2c149da0719d87fe6a5d4e820a4b0c05d130292442b93f7d755c72.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\update_Firefox.exe
  "C:\Users\Admin\AppData\Local\Temp\update_Firefox.exe"
  2⤵
  - Executes dropped EXE
  PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\update_Firefox.exe

Filesize
37KB

MD5
57e25414a682f8143667a462ad1670d0

SHA1
1c5d2eea65578438e5359c56b0f2f640eed3e40c

SHA256
fc500d11a1cc77c96868ed405d4458ac04fa9371e1a10ac22a0a89ef1d978feb

SHA512
8ce268b2c48302a9590d2ba6be4215685503650a6ffecbdac195405cbc1f32b3c9e5e3c785fb0f793b1c1805da56d0ae2c10e7027c2ab38b1a9b7cd5a3e803b1

Download Submit
memory/392-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4032-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download