8b0f9d248e67199bb7f1a778a03e4caee7d267e61d8a7d70fa1c1f6d7944e96a

Analysis

max time kernel
1775s
max time network
1778s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 02:21

Target

3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
Size

72KB
MD5

facdc4646b7f1876349cf72d6490f1d4
SHA1

27bfa893b2f73ed61764a2f2f3bfa0b03b5f76fa
SHA256

fef9c6c514e2ee00b96f6d33026f91080e43ed854d3aff103826d5063c9e7778
SHA512

8a8f08230ced45ed6e06351ee5c2ae5afe2e52a7a0284fbe74474cb9aab848a5e4226d041f4c3d50ab45c855d627e5e581a4fb66c43ace6c4ab092597985aa4a
SSDEEP

768:Fchho/bbYYwktIZwTUtv3h12jG6hdYWnXAjpWTbBbIKP077hPsxPaq77tiy/r:KjoDMYwEINR8j/Yu2pqOd77hPxy

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation	3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe

C:\Users\Admin\AppData\Local\Temp\3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
"C:\Users\Admin\AppData\Local\Temp\3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe"
1⤵
- Checks computer location settings
PID:2132

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\zvornwheuqtztwc

Filesize
52B

MD5
8353cc1932e71c992b17e84adc3d805b

SHA1
24bbe20bcc02b51a9ca5c6f84efbef84ac8fa227

SHA256
52e8f7ae0988f91766ebab39ea01266641a9f17c47ce457d6bfc1bdeda81a818

SHA512
9d47bf6ceff731595c633f484b2b230b5b20a26778ab19a770c465d9251ad3a45259fab4fc13dc995a136c9ec6f76d61ab1cf8f4e3ffde5f9f792cbdd99bea1b

Download Submit
memory/2132-0-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/2132-4-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download