6ab576f1f8ed7ec805d3668046c14badf111e18681c1a87f03e14b10c734cf23

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ab576f1f8ed7ec805d3668046c14badf111e18681c1a87f03e14b10c734cf23N.exe
Size

31KB
MD5

8bd1619fc4f5dc023ad4c6b41e79bf40
SHA1

aacd79a10c772aa0669e432533d141079b16c36a
SHA256

6ab576f1f8ed7ec805d3668046c14badf111e18681c1a87f03e14b10c734cf23
SHA512

7a90022a449db21e386b0be7c01abe51c68c03ae6383ff1d0f3d0cd65e3fccd6c863cb1d886b7daa7f2e2699fbb10f0163cfa0b0de7d789c71e76d5f19c6262e
SSDEEP

768:hmCeXuucVt13vfdHldhwyE7+OGa0ML7lak:hpeed13vfdHldhwd+OGa0MLhak

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	6ab576f1f8ed7ec805d3668046c14badf111e18681c1a87f03e14b10c734cf23N.exe

Executes dropped EXE 1 IoCs

pid	Process
4548	gffos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ab576f1f8ed7ec805d3668046c14badf111e18681c1a87f03e14b10c734cf23N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gffos.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4548	2432	6ab576f1f8ed7ec805d3668046c14badf111e18681c1a87f03e14b10c734cf23N.exe	84
PID 2432 wrote to memory of 4548	2432	6ab576f1f8ed7ec805d3668046c14badf111e18681c1a87f03e14b10c734cf23N.exe	84
PID 2432 wrote to memory of 4548	2432	6ab576f1f8ed7ec805d3668046c14badf111e18681c1a87f03e14b10c734cf23N.exe	84

C:\Users\Admin\AppData\Local\Temp\6ab576f1f8ed7ec805d3668046c14badf111e18681c1a87f03e14b10c734cf23N.exe
"C:\Users\Admin\AppData\Local\Temp\6ab576f1f8ed7ec805d3668046c14badf111e18681c1a87f03e14b10c734cf23N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\gffos.exe
  "C:\Users\Admin\AppData\Local\Temp\gffos.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gffos.exe

Filesize
32KB

MD5
88a2cea7ffd769b3cd3a88c4313a473e

SHA1
2723d282e76b604559a5baba76a505a9fd9fb919

SHA256
27b882e112b6349c2729a6b59afbb2173ebe9786f569f093497daa343a4257bc

SHA512
03d763cb13d7d7e84a5652f2b6ae133a30a710f75509cc0aad94eeaea5fc200d7afaff7e5a36609bd15d7b9a4b503e0f135003b92451d7a966fdf574e50a583c

Download Submit
memory/2432-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2432-1-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/2432-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4548-24-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4548-23-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4548-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4548-25-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download