f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe
Size

1.5MB
MD5

286b0d4cd6f1b0569cee046fa67a3130
SHA1

78f27ce18eb3d5ab6a2569c777ee23b58f0dc47d
SHA256

f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8
SHA512

38871d6534220f6159a213dffc6f133d0ca782bf8d9daaad778f53ce13bf9a669ab538dcb48215bc05c7b66fcb127e393066f3c82ac5f75faf49c5cdd51a88e1
SSDEEP

24576:L5XNN7swcZ1Tk0zQJWjwTSPLsa0QAM0fzmSaz9pUguGLYQUJEtGXpanALv2TswN3:L5fz817zQsxzf0QAM0finTfpYQUJFXmT

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
1808	f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe
1808	f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe
1808	f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe
1808	f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe
1808	f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe
1808	f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe
1808	f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe

C:\Users\Admin\AppData\Local\Temp\f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe
"C:\Users\Admin\AppData\Local\Temp\f879b73c035ac6fb1fbe6c19127af00569d58ae24191392fbe02e591573f7df8N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3804,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsq6BF5.tmp\SkinBtn.dll

Filesize
4KB

MD5
469a269cb39bbdcd1b0c87ad7f1671d6

SHA1
b4a1d87f72284d2cb9c9da6ba630f1bd04f583cf

SHA256
348edf909ff64071e76f935aa664ebbc08fb17a5d96434930e573dd1005ff27c

SHA512
b74e0b3c573fab6d12ee839ada1e1928cf3b337b9af3604ccb5caf393a5fc1d60229e0338cd0c629260d29f27f57e9578b939a1a0fab67cbb5f0e0d32595e344

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq6BF5.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq6BF5.tmp\WndProc.dll

Filesize
3KB

MD5
f0cb331dd4bd92a6ebce45e7cd1cf5ef

SHA1
b66ea0c10b08750295f2dc7c170b370402393214

SHA256
e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458

SHA512
7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq6BF5.tmp\nsDialogs.dll

Filesize
14KB

MD5
dab87894fbe35c7008be708a3d45bdee

SHA1
1159d2d106a1a2525458131013582b01a5807267

SHA256
12e30c084e0f07a00e45b9f8c5a1e77991195951ed1b2b391f425ee1d1dc5bb9

SHA512
7b6176f112a69b81f13e14f0aa0bc69968c4056ee6a92987250c2dd3297b4258b43dcae3a36aeeac22c6cf1d1919e94873b6c8dd7f2847e735bfe811c83d9147

Download Submit
memory/1808-54-0x0000000003DE0000-0x0000000003DE1000-memory.dmp

Filesize
4KB

Download
memory/1808-55-0x0000000002404000-0x0000000002405000-memory.dmp

Filesize
4KB

Download
memory/1808-74-0x0000000002404000-0x0000000002405000-memory.dmp

Filesize
4KB

Download