7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe
Size

61KB
MD5

26ee93b4fb4550e83b778dcc0f150055
SHA1

e8c890a29cea076ea9979811922573e80a613391
SHA256

7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae
SHA512

53a32194b2eaa9c8963e4c45cdc80a1df6a0841a984697a45191ffa3edd51ea0d40e402f74e843fbb5c6696d0915ce6fd4144bf8de84817b9a04edaf98e4e2be
SSDEEP

768:eFq/4qn0F1raGCI3FfeMLT++G31LSadk344524444/McoUCy6ZHtd2X7Q:qk4e0VCI33T++C1uaeN6T6Jtd2M

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe

Executes dropped EXE 1 IoCs

pid	Process
716	edurss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 716	628	7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe	91
PID 628 wrote to memory of 716	628	7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe	91
PID 628 wrote to memory of 716	628	7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe	91

C:\Users\Admin\AppData\Local\Temp\7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe
"C:\Users\Admin\AppData\Local\Temp\7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:628
- C:\Users\Admin\AppData\Local\Temp\edurss.exe
  "C:\Users\Admin\AppData\Local\Temp\edurss.exe"
  2⤵
  - Executes dropped EXE
  PID:716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\edurss.exe

Filesize
61KB

MD5
9fea7977a85363ba3d4e25e9d846ac04

SHA1
04e5a94979a5001a7ff734cd3162397434088673

SHA256
c456c57f0c6db4b759b00a52ed4f435804f6cad9302a76ba9b9ba16adaa155fb

SHA512
6098dc196ec1048f9729589c8b24b41f900cf130cdada3addd905fb2da8450e6f578f0857b7b0562bc97659db516ab102ad4ab762bd4dfdc42962c1b0e5c86d9

Download Submit
memory/628-0-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/628-1-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/716-12-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/716-13-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download