462ef03cb4d341042bf3b9c81b3a61cadaaea78e892ecd005bb83627e70c52d5

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/cfcodecdelete.exe
Size

68KB
MD5

c0d7ab0f61a060bc1f485621e2b48cae
SHA1

55f070de22d60421e285051290476fe3e485d487
SHA256

6686f66867b346b510297f9498b1688f30b77a6bf53e6acab78b1777c99d6aea
SHA512

d4eacb9e4537b2dd331440a964633239f16ef903374857b22ca723a3728bc245ab6b5c73e696ecd3d8b552064d46d877665cd6db3410d421c35624cc8dbfd2da
SSDEEP

1536:0JRE0MupgohzRg60D9mJm1w/Z4Roz+88cyqaLEYdVN25+Qavr+:0Xu/MVID9mJm1U4+8c7sNzQki

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfcodecdelete.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe
3860	cfcodecdelete.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\cfcodecdelete.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\cfcodecdelete.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsaC5A3.tmp\FRNDelete.dll

Filesize
24KB

MD5
8d4f8e9e897247e7bf1a1963e24d070b

SHA1
c1feaa4db159a478c99fe8cc109c7a10fb014130

SHA256
3a07e930d76f9d3f06749461dc13f781af6db0290561d27e9cc3c24a516e417d

SHA512
33ea7ce9aa342d64c1c182e423cb0d2e19b44fc1769bbb5e70a478028cae28e3a3557470fb827d90dcb253ae04b75fda82bf70fd1183db210f83f90e2d1280cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaC5A3.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaC5A3.tmp\ServiceBlock.dll

Filesize
24KB

MD5
8592853112ae45b942550ff1b3b3ccd7

SHA1
62535e792ec4214cd23651116acbb61d5c0bf848

SHA256
dc8696d38e17a131d4bbe66dc8b7e3a6ad164df67fe37ddcfab3a50ae5b60835

SHA512
ce232f32a8f17b5b88fd0f794ee691dd0b70070a7b6c9d9eb823de6613ab5d39297293539c8cf75b3c8d20f62b8e689c28ab0fb8d5bfc46765e80b0bac58330e

Download Submit