3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449

Analysis

max time kernel
139s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449.exe
Size

6.5MB
MD5

2b82b5601d49184917fb44181c63f594
SHA1

0a52dd49e721a5fe8c86a034c94a6348f1de952a
SHA256

3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449
SHA512

24818cc1af978c7bb967a39210b544e565a7be5aaa7350793317a850ce4ed212828ae8a8c2482e1edf782d6d571e2f4117ceff93a93c9c12262832f9231ebbf8
SSDEEP

196608:k3Q9SA7QYtLXMnB4lT2MqJctbVNtCxZeSUgj:k3Q9SA8wO4lTYJc9VNtn2j

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449.exe

pid process

1668 3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1668	3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449.exe

C:\Users\Admin\AppData\Local\Temp\3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449.exe
"C:\Users\Admin\AppData\Local\Temp\3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449.exe"
1⤵
- Loads dropped DLL
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
1⤵
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nswF02E.tmp\LangDLL.dll

Filesize
5KB

MD5
bb3707e7614a444b799d3842bf34b31b

SHA1
e4b75748e417b8a7be3a199150f4338f9d883cca

SHA256
098a384cb4c14b9639db4f4f113426d2a91d170a2affca3e6ecbe57b18d86c38

SHA512
728e7d2a7a555228f24f04829099e5f266f8e3b2f91bc44181c0d08425de158d4c1d61a25c1914bdf0ade43377462169a23b311f7cd110a1e4a07bc781ff25e4

Download Submit