418c4e4b11ebb69cf0ba6323ae10f1c1a9518f2b8e4bd65b3bace63d6fa1bb73

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fw5.exe
Size

371KB
MD5

99a61f92e2cd83591e895f23ef02cc79
SHA1

ec887c0f131efd4f5f3c44f1cc03c35e43fea0b2
SHA256

81a71b5beadef1696974ec4479a672f7528859a33413f5c63fd26f10ad5c9f06
SHA512

5eee38b77407f8e7460f0315ea3d0232ff10f0d06660393095c354b48322e41b2c4411d314203488c0270b72755d6136bf4aba165e0830a05514abbf4a6bd0d3
SSDEEP

6144:kABDgIHmDWn3LA6AuuUQ+wIwnkQjbvoluOSWDn:kABTGDWn3LA6DuUqIwnkQjeuOSyn

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TXrwQj19qwtGTvCA.exe	fw5.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TXrwQj19qwtGTvCA.exe	fw5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fw5.exe

C:\Users\Admin\AppData\Local\Temp\fw5.exe
"C:\Users\Admin\AppData\Local\Temp\fw5.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-2-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/3852-1-0x0000000000F80000-0x0000000001080000-memory.dmp

Filesize
1024KB

Download
memory/3852-3-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3852-5-0x0000000000F80000-0x0000000001080000-memory.dmp

Filesize
1024KB

Download
memory/3852-6-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/3852-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3852-7-0x0000000000400000-0x0000000000C1E000-memory.dmp

Filesize
8.1MB

Download