85389d2d325ad3039b4b6a0f16d89a436c5afde743907aa59e663272c21d921d

Analysis

max time kernel
139s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22d6ac94839b60532f7d25620a209baea55fb2456df920479e7db1657d7aac32.exe
Size

1.9MB
MD5

3c8a4ede4ff318301a2696c388f144d9
SHA1

04bb1e1d2fc007a5c8bbe99c70c019e8f4c7a932
SHA256

22d6ac94839b60532f7d25620a209baea55fb2456df920479e7db1657d7aac32
SHA512

e98c733390d4d0f3d3069ca8364e032f45e15101671977a83df14d397b3bbbd09ae052b098e13c35701cb30aa89df304a007d2aa6cb10f548e0e1ef86cdb4f63
SSDEEP

49152:Qoa1taC070dXxuRyDicCTjosCpnJKXU4tAO:Qoa1taC0+DDicKjosCzKk41

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4072	600D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4072	600D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22d6ac94839b60532f7d25620a209baea55fb2456df920479e7db1657d7aac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	600D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4072	4036	22d6ac94839b60532f7d25620a209baea55fb2456df920479e7db1657d7aac32.exe	94
PID 4036 wrote to memory of 4072	4036	22d6ac94839b60532f7d25620a209baea55fb2456df920479e7db1657d7aac32.exe	94
PID 4036 wrote to memory of 4072	4036	22d6ac94839b60532f7d25620a209baea55fb2456df920479e7db1657d7aac32.exe	94

C:\Users\Admin\AppData\Local\Temp\22d6ac94839b60532f7d25620a209baea55fb2456df920479e7db1657d7aac32.exe
"C:\Users\Admin\AppData\Local\Temp\22d6ac94839b60532f7d25620a209baea55fb2456df920479e7db1657d7aac32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Users\Admin\AppData\Local\Temp\600D.tmp
  "C:\Users\Admin\AppData\Local\Temp\600D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\22d6ac94839b60532f7d25620a209baea55fb2456df920479e7db1657d7aac32.exe 0BB1DBD3668E4F4DD05AF6C4BBFCE2D3548C4C8FBAF5A11D137845EB5B0BD2C8A812B5D6A0528AF2FB5604027A91C813762DD528B14C2604F7FD538704B64AE4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
1⤵
PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\600D.tmp

Filesize
1.9MB

MD5
7da57a8de260cf0356de0791585ea7a9

SHA1
a013dda8af56bccc1732783e8025687ce5593e4c

SHA256
6a3d697c3e3b6791791b9ae94d99017a83c8f049a5d42773c0c0cffce89f8469

SHA512
79026e4c9db6e069045eb13534f5ee98128fdf234a5573efd211d89fee8ae254456fc6ba42a46faa43f10df06e20eff7dbccbc2de5d441f0b89a4bfbbf59db79

Download Submit
memory/4036-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4072-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download