Analysis
- max time kernel
138s - max time network
109s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
09/08/2024, 14:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe
- Size 508KB
- Sample240809-rhn7vavgqd
- SHA256 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920
- MD5 c08f04edcca24592b96649acb86ffabd
- SHA1 8196c51a2d8f4d141868f11f42ed4ca8bad8e0ed
- SHA512 cf842f6bab7e648edc838c1cad823183a7514304469d944b8da55e65f0718b4f9afdc5a6f00d3aea40906ee129f13d9d9b29233bba4e307265f36447e2438c2a
- SSDEEP 6144:PW0J07EHxsWKKCbrZXDbI33z5P/kjguInr39tAOLPvI1ILz:u4CWKKCrZTGF/k8uMxtxPvvz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\tkjsidfsd 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5020 wrote to memory of 412 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 89 PID 5020 wrote to memory of 412 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 89 PID 5020 wrote to memory of 412 5020 4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe"C:\Users\Admin\AppData\Local\Temp\4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\4e9cb246cb929c43584a5a07ceb58b00855657e8ab73901a380233ccfb54a920.exe"2⤵
- System Location Discovery: System Language Discovery
PID:412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\tkjsidfsd
- Size 93B
- SHA256 82256d682203c033b7314cdd64c32986b1878e7cc365f16749c76a6652eb0905
- MD5 8c625facc8be9acc5e941e858141a854
- SHA1 fe5afd5a5c2e4713a981281033729ec1c598beba
- SHA512 0b319d1c6021da1080da69d524082f6fd961a725878cb97e741ed969abbdb937ab7930783387c6065e0cd6732d33c16b8af538fcafaa06ac6a8fd9d268e8c8f9
- MD5 SHA1 SHA512
- Path C:\Windows\tkjsidfsd
- Size 42B
- SHA256 3eb414d32d658d3c08b711e8f74ea54b933bc6f35974a613ffd4cea984a1a5b9
- MD5 eb5b054be6d2844ff01f9e557b8192b9
- SHA1 f1a419743480fa3a5ab61ddef45aab94c8e5a1f2
- SHA512 9c81e97ab328c1cc68c80cd33ee11dbc30600a0c1551ad3cd6797e03470810e676aa41416dbf61053a4e6e08cb07f9e66a205434181530b8452892993cc4ffd9
- MD5 SHA1 SHA512
- Path C:\Windows\tkjsidfsd
- Size 116B
- SHA256 575a8a379e7a072f15d20bdc382701788f2afd138926e4884e38974a73dbc7a8
- MD5 d7a6b0f0feefaba67322cd8587baf2c0
- SHA1 b17bae37d17d96cb1b0862e63f75b615cb9a7bbf
- SHA512 62f8a405fe3dfd0d0630fa583ce9a06e1ca7efe52380a94dff5ba91b3a2e856517a0dd6516e718a960ad31ca6f54dec989a89a8ba6949a9d70ffad4e0a9c2f56
- MD5 SHA1 SHA512