2bb9b5faf67798435877307f671b52b5c493066717eaecb6f14c64593de3615e

Analysis

max time kernel
38s
max time network
32s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
04/03/2023, 17:51 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6986263609´.exe
Size

339.8MB
MD5

13b70939cbd47227796e053df078eef4
SHA1

97d2965c27438f0b7464a13c87bd402be6014d94
SHA256

a6ea53fb98eca487701f84a8c2c148ce71ec9b616d78e916252f7ab843588115
SHA512

3035c762f0d9439c68be32e4055f6f85bc5068f1c099cfe0d1ac8b53f77ea952f6747915d00c8257964372ae1843a7ae527c71dac574eafe831a3d08b510c4ec
SSDEEP

98304:TB/uMwcnlWLqd2I3+jMd7hiXteNyN+9pThnPFLOAkGkzdnEVomFHKnPi:TA+nmDteNyM9p9nPFLOyomFHKnPi

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Control Panel\International\Geo\Nation	6986263609´.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2028	6986263609´.exe
2028	6986263609´.exe

C:\Users\Admin\AppData\Local\Temp\6986263609´.exe
"C:\Users\Admin\AppData\Local\Temp\6986263609´.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.