9b4017823d720ba4dfc01a60dc81c7526b29d2185ed88ef3d95b30f742f1efeb

Analysis

max time kernel
131s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b4017823d720ba4dfc01a60dc81c7526b29d2185ed88ef3d95b30f742f1efeb.exe
Size 486KB
Sample240912-ae5a8a1bnn
SHA256 9b4017823d720ba4dfc01a60dc81c7526b29d2185ed88ef3d95b30f742f1efeb
MD5 90ddd2ce313ff0b41189bc06762e41cb
SHA1 94b01f48bd9d9db72a7186a01bf52ab4597a83b5
SHA512 d55ba04ee798065bae2e39673c6c0d1939bbb9a6922acac3c2a972c28a427613695d3f6388c80f96c7b96c22733acd82155775c0418fabebc4159b915ab11258
SSDEEP 12288:T4A+AUTpldpbKSb8l52Qyvj5yMUaSv/DLO4A37z3wa362UnNuI55JPB0b+A:8A+AUTpldpbba5kv8MUaSzLO/3PwfNNW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	9b4017823d720ba4dfc01a60dc81c7526b29d2185ed88ef3d95b30f742f1efeb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	quip.exe

Executes dropped EXE 1 IoCs

pid	Process
756	quip.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b4017823d720ba4dfc01a60dc81c7526b29d2185ed88ef3d95b30f742f1efeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	quip.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 756	1664	9b4017823d720ba4dfc01a60dc81c7526b29d2185ed88ef3d95b30f742f1efeb.exe	92
PID 1664 wrote to memory of 756	1664	9b4017823d720ba4dfc01a60dc81c7526b29d2185ed88ef3d95b30f742f1efeb.exe	92
PID 1664 wrote to memory of 756	1664	9b4017823d720ba4dfc01a60dc81c7526b29d2185ed88ef3d95b30f742f1efeb.exe	92

C:\Users\Admin\AppData\Local\Temp\9b4017823d720ba4dfc01a60dc81c7526b29d2185ed88ef3d95b30f742f1efeb.exe
"C:\Users\Admin\AppData\Local\Temp\9b4017823d720ba4dfc01a60dc81c7526b29d2185ed88ef3d95b30f742f1efeb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\quip.exe
  "C:\Users\Admin\AppData\Local\Temp\quip.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

quip.exe

Path C:\Users\Admin\AppData\Local\Temp\quip.exe
Size 486KB
SHA256 4503ab7bb864576da491ce9df06e2fca07e560cdf1b331e129a443e520c19368
MD5 20785dc76f9384f0f2d0a577a604042c
SHA1 98793dc198bc6a48f5be9339d20f4972cba3fad1
SHA512 0db17803eb158461739a46818f51d0cb9debd7c08b98a6296af96389512eaf463c57bf548fd98b8450cc08287f40ac379203c145898e80282a3c8eb0bb92fb97
SSDEEP 12288:T4A+AUTpldpbKSb8l52Qyvj5yMUaSv/DLO4A37z3wa362UnNuI55JPB0b+9:8A+AUTpldpbba5kv8MUaSzLO/3PwfNNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

wipet.exe

Path C:\Users\Admin\AppData\Local\Temp\wipet.exe
Size 114B
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
MD5 SHA1 SHA512