5ea84f8f933017eb51519e628002909ba5dcf81a34830147ff2368a9d430496d

Analysis

max time kernel
141s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/tango_mp3king.exe
Size

5.4MB
MD5

0fdcebc29b02dda89cc8c9dcba2262b0
SHA1

af17b50834012fe71ce3544618a6e8632e65b8e2
SHA256

8e155b1720598fb117400b9d3c30d2652daebef1fb4057ff499d03f3459a64ad
SHA512

29ba0db467613bc4490d6b81955ceaca7e3dec3798079a48a3dcca83f620f99c8e4d15411668cb6709628f7836086f3ea38ad319fe5d3463c8a5bf58b2e4a871
SSDEEP

98304:AWB6vYSPJ6CNmFviM2TRRL3vVwsdUaUcMHQvPGMlZXiCOtYtuvE3kz:AWQPsCkl4/L+sdNyyOMlZXiCPkT

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1960	tango_mp3king.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tango_mp3king.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\tango_mp3king.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\tango_mp3king.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:8
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsw4822.tmp\InstallOptions.dll

Filesize
15KB

MD5
9a886711c559308c39c01c20e9d9a1e3

SHA1
0f27cf1cf6e4960e140651b68d72ed4b92c58e9e

SHA256
98be8860d38ad9cf31b55a1a04594de59eabad67510ba2a33ed20a80863ddfa4

SHA512
4dabdd9ea7a8330a367589a3975a9dc7286b82c66efc7db118b4d7a2db08a467851c6d3dc991668e13c4dd5473aa974e9696a2226039db94df8b198da54354a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw4822.tmp\ioSpecial.ini

Filesize
619B

MD5
bc682d341641731fec2bf5bcea21489e

SHA1
fa03e254d4d4f39ff59ee9cc5bf392d947324bb2

SHA256
eefd0fec2e8a69322ef263d677ea5d0cbb8169446b308b8a26bdd5301bc0b2b0

SHA512
ea3c49ae1480967da48938f293622b498b72e21ca8e6483d90969d189f90895eea3d6218e58eb6603d5be6f154f4f008089264e1d24d19d5b92ae1d6f1fae2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw4822.tmp\ioSpecial.ini

Filesize
605B

MD5
684955be81016ab4d1dc42051edbc7a4

SHA1
e76a9945496d813a1c7dfeec2c9228d09b852fad

SHA256
d6153d0381132efb6990e44e5922932ff06f6e1522a22af749a9777521b37be9

SHA512
5bb9303f2985fdc4fee0ddedfe4ba30cbb3490294ac1c3e2383e5611908edf95406ff2e34e9ef2f3adc21c10b85e91fed04d585b6c4af510c6858675dc432efc

Download Submit