Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 12:01
Static task
static1
Behavioral task
behavioral1
Sample
a7590a5f4406b774b2471fc27b66545565f1ab939f6a388169f780f29eb8b713.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
a7590a5f4406b774b2471fc27b66545565f1ab939f6a388169f780f29eb8b713.exe
Resource
win10v2004-20241007-en
General
-
Target
a7590a5f4406b774b2471fc27b66545565f1ab939f6a388169f780f29eb8b713.exe
-
Size
312KB
-
MD5
19d992f46bd32a800bca65dc9dafe185
-
SHA1
180663fc3a766a28745abc8a6a7faa6b8796b28b
-
SHA256
a7590a5f4406b774b2471fc27b66545565f1ab939f6a388169f780f29eb8b713
-
SHA512
9e4a6fe5bbb01b41e2881caa25b17b1e7db312224c71254a79e2e111fdac68277aa322d817198e91df547b2670b8873ac2261e2ea15b50503645d119c4e0b861
-
SSDEEP
6144:YGOXfUdRT6mCo4Em3d1k91UmaFycSbGqJWs6eQ/gU:YGOSRT6mChEm3dOXURtS96H/gU
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Executes dropped EXE 1 IoCs
pid Process 2944 fchgaxm.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\fchgaxm.exe a7590a5f4406b774b2471fc27b66545565f1ab939f6a388169f780f29eb8b713.exe File created C:\PROGRA~3\Mozilla\jwkknvd.dll fchgaxm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a7590a5f4406b774b2471fc27b66545565f1ab939f6a388169f780f29eb8b713.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fchgaxm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7590a5f4406b774b2471fc27b66545565f1ab939f6a388169f780f29eb8b713.exe"C:\Users\Admin\AppData\Local\Temp\a7590a5f4406b774b2471fc27b66545565f1ab939f6a388169f780f29eb8b713.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4544
-
C:\PROGRA~3\Mozilla\fchgaxm.exeC:\PROGRA~3\Mozilla\fchgaxm.exe -pjrnomj1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD5b83921370fa4f096fb2be920a98c18c7
SHA1b6e562c779a6247bc04e86b10bfdcafe91dbd417
SHA256a41c56a8533b7d66dcd53a70f9c6d6b31d935a3b21b31b8ad7b117df34b1246d
SHA51298a33e4637b306b59457a51086a088a03876791e8bb4e16835e813716d83a6fa548b4f6a3dd308153c7218eebcf8849ceb09ec15ca2e99208fa5dcdb80538108