f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837a

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe
Size

256KB
MD5

667419a3685b49239a11fd2a8548f410
SHA1

4a9c69e73fc19f0062a71487ac03548123f14d9b
SHA256

f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837a
SHA512

aca08a717a6bd2b8aabfdf4e7ddedf1c11de7f21581f2bc36911e294134048ceb71beabf3997ab6c5f4f3166160a1789a3ad9277106002a0ffa4121988f58bea
SSDEEP

3072:EfbA7uidA7AyemWvik8STpUpbQ47+CcfIyZ+cjstHKaGKRejorRVKWI1uaaMRc8:Vdw3Wi2T2tPPEZz8HPzRej6z0u2u8

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3784	WinDDK.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDDK.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2216	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe
2216	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe
3784	WinDDK.exe
3784	WinDDK.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3784	2216	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe	89
PID 2216 wrote to memory of 3784	2216	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe	89
PID 2216 wrote to memory of 3784	2216	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe	89

C:\Users\Admin\AppData\Local\Temp\f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe
"C:\Users\Admin\AppData\Local\Temp\f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2216
- C:\WinDDK\WinDDK.exe
  C:\WinDDK\WinDDK.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1020,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:8
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WinDDK\WinDDK.exe

Filesize
256KB

MD5
10223769cd0afd665c64ee4a175107f5

SHA1
4cc4422c18d394e5a272df7ee1b5c09b9b699ba4

SHA256
17a968efb8b7d8ff95f48ff15a9be42874ad8373f63108ccdbbc07e055932ba3

SHA512
678a65ad69b0df5e8cd3557f3516dbfc075821e595150913f5b790291feded33c5eb7bcabd0776100cd90f419b81a3bbe3077e72bba585d7391a10507f1ab9cd

Download Submit
C:\WinDDK\tmp-0.bin

Filesize
8KB

MD5
d4a4c8d0d3f12d15e49e00b0ad3bdaa1

SHA1
59a5f8e38a8b35e126091cc59bec4ccfc94d67c3

SHA256
a4353777cb0ca3d1a576b8fd820d07472fda17e7ce09733174ca0e5843ee2869

SHA512
ed9adaa640c26f893cd83eb1372558d596c5655015c9aafde308c24ddca60765e3e35c5549314ab3355469efc28860026d449ec65fef0e0e06e2c98223f45ab2

Download Submit