804ceedb4da459b12a480e99c2de2f2b0d248c0e9a928ce8746bd970e745fb8c

General

Target
4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
Size 61KB
Sample241113-z2fntazake
SHA256 804ceedb4da459b12a480e99c2de2f2b0d248c0e9a928ce8746bd970e745fb8c
MD5 fcab8db6a0da3dbc2212a61774e8927c
SHA1 72194bcca73be4e3fb42e29b9563ab60b63d2861
SHA512 95d328bc27dafa155105bea11e6759f7caafc64ff8389d777c93b44effa1f40c123e6e2d38f4b66baed95481a690971f3bdb0509b611de18cc28f31bc885e86b
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMmu:jDY9pqLnc9rUBumu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	mfcm120.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe

Executes dropped EXE 1 IoCs

pid	Process
1816	mfcm120.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mfcm120.exe	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120.exe	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
File created	C:\Windows\SysWOW64\windows.devices.printers.exe	mfcm120.exe
File opened for modification	C:\Windows\SysWOW64\windows.devices.printers.exe	mfcm120.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3420	1816	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mfcm120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1816	3052	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	87
PID 3052 wrote to memory of 1816	3052	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	87
PID 3052 wrote to memory of 1816	3052	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	87
PID 3052 wrote to memory of 3488	3052	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	89
PID 3052 wrote to memory of 3488	3052	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	89
PID 3052 wrote to memory of 3488	3052	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	89
PID 1816 wrote to memory of 2684	1816	mfcm120.exe	96
PID 1816 wrote to memory of 2684	1816	mfcm120.exe	96
PID 1816 wrote to memory of 2684	1816	mfcm120.exe	96

C:\Users\Admin\AppData\Local\Temp\4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
"C:\Users\Admin\AppData\Local\Temp\4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\mfcm120.exe
  "C:\Windows\system32\mfcm120.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\mfcm120.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 1668
    3⤵
    - Program crash
    PID:3420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1816 -ip 1816
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mfcm120.exe

Path C:\Windows\SysWOW64\mfcm120.exe
Size 61KB
SHA256 d1f03bbc944614fce1e3a111b7c4881eeafb34c0da278d8019e40dea5d1f2fa2
MD5 279274e22627fb1d5e87c16b8a554d6c
SHA1 fc0611102c83e329a241e97d6203d0570a0cd51a
SHA512 dc22472be6aa18403a27953b88887f28519eb4de600e229c1000d4d3c9ebd3011f11d1ce26d836bf31c62d357ad28cecbbc1507979cf481633993c23049ab155
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMmRj:jDY9pqLnc9rUBuml
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1816-15-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3052-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3052-11-0x0000000000400000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads