a774ee443fdfaf299c71a9e59eb9e2e4f907edc49807ff328128d164d5d855f4

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a774ee443fdfaf299c71a9e59eb9e2e4f907edc49807ff328128d164d5d855f4.exe
Size

34KB
MD5

579ba1f94a20b664bbf50263b093c750
SHA1

cb5a6bd565b0cd8792b319263422cda67b75398b
SHA256

a774ee443fdfaf299c71a9e59eb9e2e4f907edc49807ff328128d164d5d855f4
SHA512

9665e476db44bbded331b9c6536fa6327971dd6614a5739d3e8b4c79d0dfd714a3bd81b10eb68023cafcc11789e63bb67f158608eb7907200ff53ddbcc13db29
SSDEEP

768:Mp2FrwTmoTvjC0+ydn5GAX3+gUDog3FlJA:gwr2C0+yEZDogHK

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	a774ee443fdfaf299c71a9e59eb9e2e4f907edc49807ff328128d164d5d855f4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	viewpdf_updater.exe

Executes dropped EXE 1 IoCs

pid	Process
4496	viewpdf_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a774ee443fdfaf299c71a9e59eb9e2e4f907edc49807ff328128d164d5d855f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	viewpdf_updater.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 4496	3364	a774ee443fdfaf299c71a9e59eb9e2e4f907edc49807ff328128d164d5d855f4.exe	86
PID 3364 wrote to memory of 4496	3364	a774ee443fdfaf299c71a9e59eb9e2e4f907edc49807ff328128d164d5d855f4.exe	86
PID 3364 wrote to memory of 4496	3364	a774ee443fdfaf299c71a9e59eb9e2e4f907edc49807ff328128d164d5d855f4.exe	86

C:\Users\Admin\AppData\Local\Temp\a774ee443fdfaf299c71a9e59eb9e2e4f907edc49807ff328128d164d5d855f4.exe
"C:\Users\Admin\AppData\Local\Temp\a774ee443fdfaf299c71a9e59eb9e2e4f907edc49807ff328128d164d5d855f4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe

Filesize
34KB

MD5
457fce982b9c3580d08218b37566c786

SHA1
d8570acba4d46015793fe8a4536f9271e61cd0bc

SHA256
9c839f0ee771e67cf70ac0491b1cf6171d98f695c1b1d0c25f32e520a1404291

SHA512
ac5d1dff1d7ba76ce6f2fd9effa9b8a5371833aa6dcbac3e9e88634f7e93e7a1bc0f1f82bdb5d04ee4622bde34c66c0f51abb79749c98150c397390c84cc44c1

Download Submit
memory/3364-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3364-1-0x0000000000402000-0x0000000000404000-memory.dmp

Filesize
8KB

Download
memory/3364-11-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4496-12-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download