Analysis

  • max time kernel
    1561s
  • max time network
    1562s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 02:21

General

  • Target

    4f0b6605434c1355b10950024eaa9f695822278f57c29275706c0e5b29b369b0_Dumped_TDS=4F9911B3.exe

  • Size

    116KB

  • MD5

    5a580ab3f5b3806da853459e9ef7b368

  • SHA1

    df93c0f0dd694ab49646b539418b67d83eafccb5

  • SHA256

    5f60eed8e27867c843387fe7fece3af688586a40c8d3dd2c27647b23cc200fdc

  • SHA512

    91ecd8f00f4cd6c7d199eb365cb7cfa414bcab41b144fe7a5f43529e560201a81284cdb3a3d18d252e2eb4429a67f2db5718eacc8bf1eeb072958c0a4be20a3b

  • SSDEEP

    1536:tf/YvFSSZtDgN+DrDkDEFtCwbfF89lGL+vpCYC:Z/Yv0SZtDgN+Dr+ErbfF89llpTC

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f0b6605434c1355b10950024eaa9f695822278f57c29275706c0e5b29b369b0_Dumped_TDS=4F9911B3.exe
    "C:\Users\Admin\AppData\Local\Temp\4f0b6605434c1355b10950024eaa9f695822278f57c29275706c0e5b29b369b0_Dumped_TDS=4F9911B3.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\vdjvzwnjxxqmrskmukyfebqfjutpiyaq

    Filesize

    16B

    MD5

    2ccd4a6682dab48393fc5677e813b1b7

    SHA1

    2e935c2a7b52aab263a7f725e5aa49506dff27a0

    SHA256

    69c83915db0c6dac2871e5fe81d01f406466fc85aeaab44702ac1b8c1c34b523

    SHA512

    afc02b5411f728cd6e9a36353214ba1d5e2cfcf7bbc6381413cd365bd10afc698e41e68725a3977dfeb50fc7f658c2747a28bae6f6715dfd1f5e63936f226e43

  • memory/2520-0-0x0000000000A60000-0x0000000000A7D000-memory.dmp

    Filesize

    116KB

  • memory/2520-1-0x0000000000A60000-0x0000000000A7D000-memory.dmp

    Filesize

    116KB