Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
25/07/2024, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe
Resource
win7-20240704-en
4 signatures
150 seconds
General
- Target c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe
- Size 2.8MB
- Sample240725-p3672sseqd
- SHA256 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe
- MD5 84b54230612be88a2b3b8a50a7598951
- SHA1 85d6e44b65358bc33659b689c931774f557be7ee
- SHA512 6d53114fbf091e196cbe670e7041c4eabdc7fd12779953b4682ded62d6435c31a372f88a342c8e21de5fb58e3105e5fd33238e6b3a72bfe460e43e8f23256bc2
- SSDEEP 49152:J/xfJsHBQOR1NZj41W3ZxB+e3P3OTtnEIXgaq6k1nFepkimJTOauIZD:J/xfJsHBQObNh4M3ZxB+e3P3OlEIX3Ry
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\GPU c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4256 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe 4256 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe 4256 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe 4256 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe 4256 c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe"C:\Users\Admin\AppData\Local\Temp\c7779e5517c234740559dd3de8934a79165b2edbe50de2b867de7191be722fbe.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4256