Analysis

  • max time kernel
    1790s
  • max time network
    1443s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 02:21

General

  • Target

    46ca6b1972c81eab77202146184afe95b797bd4e3788c59e8036e748b55fc28c_TDS=4FB566FC.exe

  • Size

    56KB

  • MD5

    a73ac649aebb5530a09b8fe03ec465e3

  • SHA1

    d1f1e3faec50e7eddffba2889a69c8601eb8dc07

  • SHA256

    46ca6b1972c81eab77202146184afe95b797bd4e3788c59e8036e748b55fc28c

  • SHA512

    445f0a3c71362671b0d2722a73934ada8ee0e3c6e953bd3be28672f21dcc72593b7d2d4c86a61cc5f9f5bdf57d8df360cfdaa7d42c6fcae8ca8985b20d8d8190

  • SSDEEP

    768:msLq/bYHR22nktR88rcBjjPkY5e2fD+x6LJ7hR5iSa:Tqzg2BtR8imvPkY5P+xcJ5iS

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\46ca6b1972c81eab77202146184afe95b797bd4e3788c59e8036e748b55fc28c_TDS=4FB566FC.exe
    "C:\Users\Admin\AppData\Local\Temp\46ca6b1972c81eab77202146184afe95b797bd4e3788c59e8036e748b55fc28c_TDS=4FB566FC.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\nsxoccjlnlxcgcf

    Filesize

    52B

    MD5

    721da39c6a6df0cd8cfc82647b5e3c18

    SHA1

    f9ff38e9b602879301b1040006066846a1af2cc2

    SHA256

    23b306291f9710ea1928237dfcb0c4984eca2998be616aa7b6e84932d43f1434

    SHA512

    a6ba25a00b468e113a4e18374854abd3a47154c3b2cc95783759f770e4a70d649e0f71852b04d986d13022118a1f2f3e5ce50cf366d19b7eaf22f244e8a1afde

  • memory/2684-1-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/2684-0-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2684-5-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB