7db226ce1cc2033c23d2debcb1480326c148138f57be405cff75243fcf142c09

Analysis

max time kernel
109s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7db226ce1cc2033c23d2debcb1480326c148138f57be405cff75243fcf142c09N.exe
Size

60KB
MD5

d1b0981825d40ce5b875b18b79b125e0
SHA1

b0238f58220b25d3f75f2c5d695acbf8c2d8eb53
SHA256

7db226ce1cc2033c23d2debcb1480326c148138f57be405cff75243fcf142c09
SHA512

b24d969fe77d8aab4042509a46777279c7c3992978ed1f3e8103010f5fb2b3a764e953c20a1912e0de4aea2d8e35517a5c0a73cdaf90f6c9633a324023824f08
SSDEEP

384:asjPGY2HXgrkEYYhQ98E8I1XAV/QcaYpATUgch1A9NB/erxFpktRB+bQ:aePG5H8XhKD8ISZQjkgs1lxFQu8

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	7db226ce1cc2033c23d2debcb1480326c148138f57be405cff75243fcf142c09N.exe

Executes dropped EXE 1 IoCs

pid	Process
4084	winupdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7db226ce1cc2033c23d2debcb1480326c148138f57be405cff75243fcf142c09N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 4084	2520	7db226ce1cc2033c23d2debcb1480326c148138f57be405cff75243fcf142c09N.exe	82
PID 2520 wrote to memory of 4084	2520	7db226ce1cc2033c23d2debcb1480326c148138f57be405cff75243fcf142c09N.exe	82
PID 2520 wrote to memory of 4084	2520	7db226ce1cc2033c23d2debcb1480326c148138f57be405cff75243fcf142c09N.exe	82

C:\Users\Admin\AppData\Local\Temp\7db226ce1cc2033c23d2debcb1480326c148138f57be405cff75243fcf142c09N.exe
"C:\Users\Admin\AppData\Local\Temp\7db226ce1cc2033c23d2debcb1480326c148138f57be405cff75243fcf142c09N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\winupdate.exe
  "C:\Users\Admin\AppData\Local\Temp\winupdate.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\winupdate.exe

Filesize
60KB

MD5
098a189f25d48e3651e10b41aea0a500

SHA1
6410ff6a1d17b9fb428591359aa90919bd48187a

SHA256
22c4f902fd01eccf602b50e3e75a115505a27d658b719f32373a1280abde9879

SHA512
823a7993e363b56c1f58f24a98d7504b4265984af433dd03c44a001990c2be7b8c077a85131ab310f80e3295d2d0070e3071cd16569e26ed75c436cb28ced3e6

Download Submit
memory/2520-0-0x0000000000500000-0x0000000000512000-memory.dmp

Filesize
72KB

Download
memory/2520-1-0x0000000000501000-0x0000000000502000-memory.dmp

Filesize
4KB

Download
memory/2520-10-0x0000000000500000-0x0000000000512000-memory.dmp

Filesize
72KB

Download
memory/4084-11-0x0000000000500000-0x0000000000512000-memory.dmp

Filesize
72KB

Download