480cf183dc58edf2edda7fddb03dd2c84aefa7c5b2e93cfeef47cf55c370b6b0

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

1.1MB
MD5

238ebbc3ffc4526010514f362f9d7a80
SHA1

f9feceeec0e2e7cae4127e5fe9bc7aef6b4d6545
SHA256

415749c46831eb89b8bbb3c386495ac06edcc21bf694a992f14cd94af0276a92
SHA512

f3f4357c3198f399dbed3b01617ec2ab6f74e70ddc0654e41f6340030e477250d451cab868ce3f7c56810e76bfc7618945c24bc0025f77f23396809144ace33b
SSDEEP

24576:WnUhV0C62Uze3Hee3MLSXNQkidRaNTU4WziQf5QiFGWEAIaYy7pO0y:WnU0khHee3MLi4CYiQrFGWEAIBB0y

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3000	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1388,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
1⤵
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ci0-temp\install.bmp

Filesize
20KB

MD5
f6dc62a8543452e5fac9f4dc897b47c5

SHA1
3d421d5a6ce66a2ac9a117056ba945a97ece81f9

SHA256
a6a8fa6296f63cf3cf3c181f7f483b053447597d6825fbcfef73a87ece5ce026

SHA512
525db38873459986e6e02457bb9894f6dc50af0abe15eff8af758b3f589fe5f34e71b03155253e6f835d30508ea852c68b060e24d671c70186fe3adb9d6c10c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\gert0.dll

Filesize
88KB

MD5
33976355fddbceb0fbe54887ee4d1596

SHA1
914c49a8a58605186d7dabeb3a67b88578c84c14

SHA256
51baaf313b57462eaa38aaf69aea6e8dbbc20f3714343817266e7f35bc2235fb

SHA512
be34e4042074da841cfbdbe3a379489b7a968f69a2bb372ce5925e0328d259af2fc0d29d02a787b8d4cfe70158bfc018bf7f6da35c26e670aea847efe3cb8389

Download Submit