8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.exe
Size

1.7MB
MD5

a6e152d3c298d94d11e27afde73af703
SHA1

3e85ec869e6556b22baf0f105385a5e945d5483b
SHA256

8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1
SHA512

b30b17e9c4cb6d2977075e88053c5284308c7a8f374a7350946d90a7d3370c433ace1650562894e0e9f9cf5f91cf76c3372b5328a979add8d37ee88d28f819eb
SSDEEP

24576:j7FUDowAyrTVE3U5F/8eLM3+4thlzr6lgpUEzJMhtw8gEYKByNEeR:jBuZrEU7M3BDlzr6Mz+w8gEYK

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2516	8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2516	1928	8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.exe	83
PID 1928 wrote to memory of 2516	1928	8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.exe	83
PID 1928 wrote to memory of 2516	1928	8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.exe	83

C:\Users\Admin\AppData\Local\Temp\8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.exe
"C:\Users\Admin\AppData\Local\Temp\8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\is-CGE73.tmp\8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CGE73.tmp\8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.tmp" /SL5="$5021A,837598,832512,C:\Users\Admin\AppData\Local\Temp\8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-CGE73.tmp\8ff12cc5e4816d07e534854bcd11192457eec896cedd7882c7edde1cc7a65eb1.tmp

Filesize
3.1MB

MD5
d36dc0f4df953a231d9247c6abc22d80

SHA1
d47b2600892a58ed7933e8c0f5cca43f53ae9f3c

SHA256
58655e5d228120d2a3490b83fdab48040d353ae4d42590c94c413474a278785c

SHA512
429c314acb05a499214fbe01f0cc5a17eaa32b43b2c28e72bb15acb93c2bd55b596197f1310b3df675794f4e853950f142c4956d145fbc607aa262f20c3c5bf0

Download Submit
memory/1928-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1928-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1928-8-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1928-13-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2516-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2516-9-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2516-11-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download