6c762972df79dd08233cf08cc9b7923295c1178f87bd636615facacca333809d

Analysis

max time kernel
120s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa8d5bf5f759aac799df0e726a94ccf0N.exe
Size

85KB
MD5

fa8d5bf5f759aac799df0e726a94ccf0
SHA1

661888b72ea52aab09af6cd573ca4dc0d29f75b4
SHA256

6c762972df79dd08233cf08cc9b7923295c1178f87bd636615facacca333809d
SHA512

49f66d4cd831dbdfbd3594122d9db86ffb5c5e881a89ef691608ccd2dcffadd6a5826d9995a9f59cb7303a46bfc5bc71e90ad8d91c32b049e063eea8512bdb16
SSDEEP

96:2zDAJCBY1T/m4cfnp37eZMykBj7KTdcfnp3BWvUSaiUnhWzswO3ixycKYbik2:w6BYprPCYp+ai6hW4vinx2

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	fa8d5bf5f759aac799df0e726a94ccf0N.exe

Executes dropped EXE 1 IoCs

pid	Process
4240	kgfdfjdk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa8d5bf5f759aac799df0e726a94ccf0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kgfdfjdk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 4240	3656	fa8d5bf5f759aac799df0e726a94ccf0N.exe	86
PID 3656 wrote to memory of 4240	3656	fa8d5bf5f759aac799df0e726a94ccf0N.exe	86
PID 3656 wrote to memory of 4240	3656	fa8d5bf5f759aac799df0e726a94ccf0N.exe	86

C:\Users\Admin\AppData\Local\Temp\fa8d5bf5f759aac799df0e726a94ccf0N.exe
"C:\Users\Admin\AppData\Local\Temp\fa8d5bf5f759aac799df0e726a94ccf0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe
  "C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe

Filesize
85KB

MD5
f18b2f7522338a28178b2b56ef329223

SHA1
2e7209a7b59e40d47801e343a5a5ded262f5e47f

SHA256
f101051ea356bf7e91098fd59d8ed283cf3c8257979c2c3efeeb82e42ad131a0

SHA512
5815a81995b473c630abbba96de569c5571db99b25b6972eb27a53b6a65154d7db7a7790fa4cef4f874494a86814fe220dcc93b9095c5d25fbeb9c5bb082db6d

Download Submit
memory/3656-0-0x00000000008E0000-0x00000000008F5000-memory.dmp

Filesize
84KB

Download
memory/3656-9-0x00000000008E0000-0x00000000008F5000-memory.dmp

Filesize
84KB

Download