2532b436d5e8cd8d04f3774159fc6efb7a5409a655bdcac3e58183a69bbe3d5d

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

797KB
MD5

777228ba067c7f49d22607d3c583f2fd
SHA1

5d69b4418290f2332c480f15707f14a3bb82d41e
SHA256

2532b436d5e8cd8d04f3774159fc6efb7a5409a655bdcac3e58183a69bbe3d5d
SHA512

8068380bdda30a7314ff57a2d5b1b1f1f811798cb070246522e8d971bd8d18cf4b9a22f10ee48db0440459469c8dfd0070ce701d648f79827be5f62ebf352d24
SSDEEP

12288:SgxNT6NGm64BppLRE3KEIBI3Kobryoyhwh5K2H1tMzoaukjPx0ZASoZQ:SgxZIBI3KsyojMzoaukjP+IQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2560	Bootstrapper.exe

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

Filesize
4KB

Download
memory/2560-1-0x0000000000200000-0x00000000002CE000-memory.dmp

Filesize
824KB

Download
memory/2560-2-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2560-3-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

Filesize
4KB

Download
memory/2560-4-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download