36096d4b30cf0f34cd0be564688532d8b36cc4b374457f66e463f8aefb66c908

Analysis

max time kernel
92s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fm.exe
Size

8.2MB
MD5

8567d20bad7c14dc00655368125bdeac
SHA1

a2d60a865fba4d07b0c1b07e863c519aa4e42f70
SHA256

0148a61812c9b84aceee827d05218a4dccefc989c73607a09c46478bbf18229e
SHA512

684009efb0a3c0747fc14865637d8819498d35048ec4a0e3cdd7b655db7d3ccde1e5b908d2ad0d976fd4f10fd41aab45622dd5fd6f8a31c4bb77c7865b23d765
SSDEEP

196608:pg03BAYqhrnyQj/y+198yhXD9PgQMYMyZ3UwXQTUPAFY/w:/2YqhrnyQj/1eAUfwEYY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fm.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 1628	4444	Fm.exe	83
PID 4444 wrote to memory of 1628	4444	Fm.exe	83

C:\Users\Admin\AppData\Local\Temp\Fm.exe
"C:\Users\Admin\AppData\Local\Temp\Fm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads