c0f1fcf51e692ff417adead33da7b06e764ec5c4a9907b364fa86feef6bdfbe9

Analysis

max time kernel
150s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0f1fcf51e692ff417adead33da7b06e764ec5c4a9907b364fa86feef6bdfbe9.exe
Size

28KB
MD5

671e6b2dda7ae10ffec7796d73abae8d
SHA1

4e10b5d76bebaa5aa8a7903028619264f0a706d6
SHA256

c0f1fcf51e692ff417adead33da7b06e764ec5c4a9907b364fa86feef6bdfbe9
SHA512

23243e6590a245f314e30abdd4fc0d4bc088eccf101cce82c1e03635a28de8df0298356c4748e66c147a53d11d59d93a6588bd3a12969cdd4c295d416a4e2f6a
SSDEEP

384:pfYXCqgQ0YuuclmIt13vfdHldhwLGEGS+OGa0MPKS:hmCeXuucVt13vfdHldhwyE7+OGa0MiS

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	c0f1fcf51e692ff417adead33da7b06e764ec5c4a9907b364fa86feef6bdfbe9.exe

Executes dropped EXE 1 IoCs

pid	Process
3576	gffos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 3576	1636	c0f1fcf51e692ff417adead33da7b06e764ec5c4a9907b364fa86feef6bdfbe9.exe	82
PID 1636 wrote to memory of 3576	1636	c0f1fcf51e692ff417adead33da7b06e764ec5c4a9907b364fa86feef6bdfbe9.exe	82
PID 1636 wrote to memory of 3576	1636	c0f1fcf51e692ff417adead33da7b06e764ec5c4a9907b364fa86feef6bdfbe9.exe	82

C:\Users\Admin\AppData\Local\Temp\c0f1fcf51e692ff417adead33da7b06e764ec5c4a9907b364fa86feef6bdfbe9.exe
"C:\Users\Admin\AppData\Local\Temp\c0f1fcf51e692ff417adead33da7b06e764ec5c4a9907b364fa86feef6bdfbe9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\gffos.exe
  "C:\Users\Admin\AppData\Local\Temp\gffos.exe"
  2⤵
  - Executes dropped EXE
  PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gffos.exe

Filesize
28KB

MD5
8b282dbcf20cbd2e455b3a8877315bca

SHA1
8e2cf640fbc06417f54792403654a1139e724491

SHA256
2f255a29360440dbb192aaca2ecb49b4ef80316110553a1e3824e1b59e41945a

SHA512
d1777eba0d50fd3de27777dda44769e3ff3f2a2de7dec3e60b6dd788f502a25e8d2e9c520d255b9c4572419f2e626228a9d81bbc65380178f80ba3bb3a5719e2

Download Submit
memory/1636-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1636-1-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download
memory/1636-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3576-23-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3576-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download