Analysis
- max time kernel
121s - max time network
124s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system - submitted
25/07/2024, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe
Resource
win7-20240704-en
4 signatures
150 seconds
General
- Target c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe
- Size 2.8MB
- Sample240725-p3672sseqd
- SHA256 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe
- MD5 84b54230612be88a2b3b8a50a7598951
- SHA1 85d6e44b65358bc33659b689c931774f557be7ee
- SHA512 6d53114fbf091e196cbe670e7041c4eabdc7fd12779953b4682ded62d6435c31a372f88a342c8e21de5fb58e3105e5fd33238e6b3a72bfe460e43e8f23256bc2
- SSDEEP 49152:J/xfJsHBQOR1NZj41W3ZxB+e3P3OTtnEIXgaq6k1nFepkimJTOauIZD:J/xfJsHBQObNh4M3ZxB+e3P3OlEIX3Ry
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2808 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe 2808 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe 2808 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe 2808 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe 2808 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe"C:\Users\Admin\AppData\Local\Temp\c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2808