7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe
Size

162KB
MD5

24af22c41f04df67b15f69a28386e4d7
SHA1

00e6083c66ab30c4dca11c7b158e19792ca54110
SHA256

7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2
SHA512

d9860cf961c97fd361fa72991276720d4ba184ae2d647019914c08fd0bdc54dedd62bb2e6266194bf50684920ef1a8fc02a5f478538cee7c6823e76e629224d6
SSDEEP

3072:oEeK1LS+T08/rh+hj3yBUm7Qm+agcwN0aVQVPhDFaw:oE5eTGNoj307Aa6uJnf

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1536	7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe

Executes dropped EXE 1 IoCs

pid	Process
1536	7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2060	7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2060	7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe
1536	7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1536	2060	7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe	90
PID 2060 wrote to memory of 1536	2060	7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe	90
PID 2060 wrote to memory of 1536	2060	7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe	90

C:\Users\Admin\AppData\Local\Temp\7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe
"C:\Users\Admin\AppData\Local\Temp\7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe
  C:\Users\Admin\AppData\Local\Temp\7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4080,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7a90c2f1ec7f965484d0bcf7044c0a26991e61cf0d44fb60cba1e6a046be1ad2.exe

Filesize
162KB

MD5
08b1f16acc3579075b6c7e1cd199071c

SHA1
c198031ff9ee5b4fe5a6e8aeab0d153a5e412eb8

SHA256
be66fc9d214834167758955fd0624691a3e61b2037a1717336874fec715d072e

SHA512
7e9be656249ba102f16768242a6598c794b9e6d6897c5472d6a82024565fb412355f05a93c96a53824d7219337639bd7b5daa0f0bd804c346f94c9bce710eaad

Download Submit
memory/1536-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1536-19-0x00000000001B0000-0x00000000001DE000-memory.dmp

Filesize
184KB

Download
memory/1536-25-0x00000000014E0000-0x00000000014FB000-memory.dmp

Filesize
108KB

Download
memory/1536-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1536-26-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2060-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2060-1-0x00000000000F0000-0x000000000011E000-memory.dmp

Filesize
184KB

Download
memory/2060-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2060-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download