06812518a722af6f98fbd8c3a5ace0cad1c6d53477972618728e64bafcbc948c

Analysis

max time kernel
135s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 15:13

Target

EnableLoopback.exe
Size

82KB
MD5

ea240c9d733ad54a79faaca19ba8d376
SHA1

2c1d1b3aa6aec6e6e7af7f64637029971a37ba77
SHA256

2c2aa55ab99b5a34eb78ded93e46c4d5fef44077847281e124473c20de5cf165
SHA512

d3815bf7b5af7aa5dbf717f404bdac9538adeaff57cf6ec38c3724d7179fb1f31231009941a671bdd15516e47ff346afa8738bc399c4e57cb840def6821f6464
SSDEEP

768:JyEI16zcI2eTcvE+m/ljPb0O7/Al25znrSh7A+g4CqnZ86qmmlk8x3Oqxf1mlZxd:K1H50wOLFzrSh7QwZhxmlk8xDfInfZ

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

EnableLoopback.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	EnableLoopback.exe

C:\Users\Admin\AppData\Local\Temp\EnableLoopback.exe
"C:\Users\Admin\AppData\Local\Temp\EnableLoopback.exe"
1⤵
- Checks computer location settings
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:2476

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4484-0-0x000000007462E000-0x000000007462F000-memory.dmp

Filesize
4KB

Download
memory/4484-1-0x0000000000C00000-0x0000000000C18000-memory.dmp

Filesize
96KB

Download
memory/4484-2-0x0000000005A10000-0x0000000005FB4000-memory.dmp

Filesize
5.6MB

Download
memory/4484-3-0x0000000005500000-0x0000000005592000-memory.dmp

Filesize
584KB

Download
memory/4484-4-0x0000000005FF0000-0x0000000005FFA000-memory.dmp

Filesize
40KB

Download
memory/4484-5-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/4484-6-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/4484-7-0x000000007462E000-0x000000007462F000-memory.dmp

Filesize
4KB

Download
memory/4484-8-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/4484-9-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download