1a8c0bf1998f186b047f7026c4eece9c0f28e6f33bb7527b96f1be2ba97b1bca

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a8c0bf1998f186b047f7026c4eece9c0f28e6f33bb7527b96f1be2ba97b1bca.exe
Size

39KB
MD5

57cbfee7a49ccf11c832e91a863bfd35
SHA1

c13d674b353a93250aa8f329ec6763dac7e1cc9d
SHA256

1a8c0bf1998f186b047f7026c4eece9c0f28e6f33bb7527b96f1be2ba97b1bca
SHA512

fb06c7c54c8666d3807719178eb69537878a63327253e536547a2434dfefc0a88528fd0f5ce50459b4342ccfd6e62b65b10e38dac9049ec0883a90c8ad8144c4
SSDEEP

768:pdA4TOKjHXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8tvCkA8SsBiaojlnk23lo:nA4TljXRrs9sINeZEtejlIkoLN127BFv

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	1a8c0bf1998f186b047f7026c4eece9c0f28e6f33bb7527b96f1be2ba97b1bca.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	update_Firefox.exe

Executes dropped EXE 1 IoCs

pid	Process
4804	update_Firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a8c0bf1998f186b047f7026c4eece9c0f28e6f33bb7527b96f1be2ba97b1bca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update_Firefox.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4804	4144	1a8c0bf1998f186b047f7026c4eece9c0f28e6f33bb7527b96f1be2ba97b1bca.exe	84
PID 4144 wrote to memory of 4804	4144	1a8c0bf1998f186b047f7026c4eece9c0f28e6f33bb7527b96f1be2ba97b1bca.exe	84
PID 4144 wrote to memory of 4804	4144	1a8c0bf1998f186b047f7026c4eece9c0f28e6f33bb7527b96f1be2ba97b1bca.exe	84

C:\Users\Admin\AppData\Local\Temp\1a8c0bf1998f186b047f7026c4eece9c0f28e6f33bb7527b96f1be2ba97b1bca.exe
"C:\Users\Admin\AppData\Local\Temp\1a8c0bf1998f186b047f7026c4eece9c0f28e6f33bb7527b96f1be2ba97b1bca.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\update_Firefox.exe
  "C:\Users\Admin\AppData\Local\Temp\update_Firefox.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\update_Firefox.exe

Filesize
39KB

MD5
2eec69ab1bb03e61edf6bff4f2ca3ac7

SHA1
da4dee9f55fb1eced12e86cf986834f1c9a95968

SHA256
68f8bd62aa2e7392935f0b003f540647ddb66a2fa9184e0c23c4da0b16bce36d

SHA512
844b7dc478d0c75f116e9c1692979e5ec894088ecb3f0284f0414aea8bb613b3961424d37ffec589782e4ff50ca21e99a981b60369483ac4cdfb6d0ad611488b

Download Submit
memory/4144-0-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/4804-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download