Analysis

  • max time kernel
    146s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 10:48

General

  • Target

    FSResizer43/FSResizer.exe

  • Size

    1.1MB

  • MD5

    bdf06daf8f493efa6a268109c3b42fb4

  • SHA1

    74b1327dc553779c44fa58bd6dd06c6ec889ac4c

  • SHA256

    0398c839ad2e88201479ad4497ed4d24e737a516f7799f5b63dff3899e8bde23

  • SHA512

    f97a766aa144792dd240539d7f8396d5878b536d8d4656277494f719b156aa68c3dbe1b863cba44af75db702772fc10784091538697284b279225cad2d854ff8

  • SSDEEP

    24576:7l3lU2dontsW2aFjHg39neko6Z7iZeWn7qR6qvyTMm/7YBC:7rLotsWLFDgoko6Z7i4W2R6DkU

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FSResizer43\FSResizer.exe
    "C:\Users\Admin\AppData\Local\Temp\FSResizer43\FSResizer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:3960
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4056,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
    1⤵
      PID:2092

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3960-0-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-1-0x0000000000970000-0x0000000000973000-memory.dmp

      Filesize

      12KB

    • memory/3960-2-0x00000000009C0000-0x00000000009C1000-memory.dmp

      Filesize

      4KB

    • memory/3960-3-0x0000000000460000-0x0000000000461000-memory.dmp

      Filesize

      4KB

    • memory/3960-4-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-5-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-6-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-7-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-8-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-9-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-10-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-11-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-13-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-12-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-14-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-15-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-16-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-17-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-18-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-19-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-22-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-21-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-20-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-23-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-24-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-25-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-26-0x0000000000400000-0x000000000079E000-memory.dmp

      Filesize

      3.6MB

    • memory/3960-27-0x00000000009C0000-0x00000000009C1000-memory.dmp

      Filesize

      4KB

    • memory/3960-29-0x000000006AD80000-0x000000006ADFE000-memory.dmp

      Filesize

      504KB