e66f23a856eea3a96bcf1b7a3793991edfeb13570715844eecedd2817d946c44

Analysis

max time kernel
136s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e66f23a856eea3a96bcf1b7a3793991edfeb13570715844eecedd2817d946c44.exe
Size

1.6MB
MD5

d6fb79fe0b0e4919bc6aca9b5ba72f1c
SHA1

624d07caf9673bcfd44cffcbdc67b187d93f9d59
SHA256

e66f23a856eea3a96bcf1b7a3793991edfeb13570715844eecedd2817d946c44
SHA512

48986e2cb27b41ff9bf23318dad78f3a2f66b43f16bf7a72b4b0e634faabe689543a18a52f8be2a17f37ae9144323b6cb27df9ddf5e5bddad54efb82053a47e6
SSDEEP

12288:bzTuN9abJauyXTvB+R8WNODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:bzCN9abWvBHPDVv7DxAZquHPH9k

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	e66f23a856eea3a96bcf1b7a3793991edfeb13570715844eecedd2817d946c44.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e66f23a856eea3a96bcf1b7a3793991edfeb13570715844eecedd2817d946c44.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2572	e66f23a856eea3a96bcf1b7a3793991edfeb13570715844eecedd2817d946c44.exe

C:\Users\Admin\AppData\Local\Temp\e66f23a856eea3a96bcf1b7a3793991edfeb13570715844eecedd2817d946c44.exe
"C:\Users\Admin\AppData\Local\Temp\e66f23a856eea3a96bcf1b7a3793991edfeb13570715844eecedd2817d946c44.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-0-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download
memory/2572-1-0x0000000000850000-0x00000000008B7000-memory.dmp

Filesize
412KB

Download
memory/2572-6-0x0000000000850000-0x00000000008B7000-memory.dmp

Filesize
412KB

Download
memory/2572-11-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download