83fd2015a5499a8c2703d91aa047d0f099b85e8aa5ef9f2643a4eda4144a8772

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe
Size

2.7MB
MD5

b7a0695707383c13e5ead57b86252398
SHA1

808ce65c31d8bd65d243d8961330068101773118
SHA256

6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478
SHA512

b1b4e6fbdace24d8e3e44cf5199c605352dbd2eaa92af695c49132ce978f1a1052c0e2492cd7264f6e49c99797eb5414c12047f244aa7be93ba6c34e3819234a
SSDEEP

49152:94yT+P66XbOP/ZzA2DItg1Hoaz6wecYfFkURwlhyAuLjf/IVgs5+xP:1TE66yXZ02DwUHoazRofxIhELjf/IVgs

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Control Panel\International\Geo\Nation	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe

Executes dropped EXE 1 IoCs

pid	Process
2204	Alidia Dupont.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2204	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alidia Dupont.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2800	cmd.exe
1204	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1204	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4944	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe
4944	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe
2204	Alidia Dupont.exe
2204	Alidia Dupont.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe
Token: SeIncBasePriorityPrivilege	4944	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe
Token: SeDebugPrivilege	2204	Alidia Dupont.exe
Token: SeIncBasePriorityPrivilege	2204	Alidia Dupont.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 2204	4944	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe	90
PID 4944 wrote to memory of 2204	4944	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe	90
PID 4944 wrote to memory of 2204	4944	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe	90
PID 4944 wrote to memory of 2800	4944	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe	91
PID 4944 wrote to memory of 2800	4944	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe	91
PID 4944 wrote to memory of 2800	4944	6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe	91
PID 2800 wrote to memory of 1204	2800	cmd.exe	93
PID 2800 wrote to memory of 1204	2800	cmd.exe	93
PID 2800 wrote to memory of 1204	2800	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe
"C:\Users\Admin\AppData\Local\Temp\6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\Alidia Dupont.exe
  "C:\Users\Admin\AppData\Local\Temp\Alidia Dupont.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1568
    3⤵
    - Program crash
    PID:3060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\6f2c23f7e99a6712509c9f30f9ce3dcd9ea2bfd6ea020ed3b8dcb3641bd34478.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2204 -ip 2204
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Alidia Dupont.exe

Filesize
2.7MB

MD5
08bd7e76c06a1bd1d003643dff6e2324

SHA1
e86d352cb56f124267ff1b8ef84111f863d928b0

SHA256
dcbd1357bd2627e9b53f3b35605fbd49afe46d4329e4a6e3bb92a983136c87c1

SHA512
e72d7708b1fe6035bd43e5243f43a7a65ff42d97c14165a6bbf713d0ddc54fe6069b6ddf87e9149165da4b9b2fcd4c959984ed2f5657ceabe887c10a4db3f829

Download Submit
C:\Users\Admin\AppData\Local\Temp\Alidia Dupont.exe

Filesize
2.7MB

MD5
31d15f1f0a4e69d48a78a6bd1f25234f

SHA1
b907d887dab68ba8e62bd4ace55b1caf6ffbd42c

SHA256
4ee90a945074bd9ae7355a215eb62e1fd4e75ea90858a8e4f0835f88059f8815

SHA512
9b7d27d134c01543299caf4e71c92f83adb2b7fee0905655751e4634834ddf0815739847dddf9e5719133a78dc6058163efc4c276249d152690fe770504cda9c

Download Submit
memory/2204-42-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/2204-41-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/2204-40-0x00000000002F0000-0x00000000005B2000-memory.dmp

Filesize
2.8MB

Download
memory/2204-39-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4944-8-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4944-7-0x0000000007360000-0x00000000073C6000-memory.dmp

Filesize
408KB

Download
memory/4944-0-0x000000007493E000-0x000000007493F000-memory.dmp

Filesize
4KB

Download
memory/4944-9-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4944-6-0x0000000005A90000-0x0000000005A9A000-memory.dmp

Filesize
40KB

Download
memory/4944-5-0x000000000AAC0000-0x000000000AB52000-memory.dmp

Filesize
584KB

Download
memory/4944-37-0x000000007493E000-0x000000007493F000-memory.dmp

Filesize
4KB

Download
memory/4944-38-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4944-4-0x000000000AFD0000-0x000000000B574000-memory.dmp

Filesize
5.6MB

Download
memory/4944-3-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4944-2-0x0000000007800000-0x0000000007A24000-memory.dmp

Filesize
2.1MB

Download
memory/4944-1-0x0000000000450000-0x0000000000712000-memory.dmp

Filesize
2.8MB

Download