34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc.exe
Size

67.8MB
MD5

edc35b0b45d4ef1ac4f78da70f38e8cb
SHA1

31027d19dc66ce1e565b88dba0b43221999f4592
SHA256

34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc
SHA512

6ef764e0e0ef5e02f327e81fab67440d6840d14ae45e6fd7c618708cde7b1d59c86799bc1a89e4db98fd2ba1bc79a9d9fbe877afe807b891ca42348d97b5d308
SSDEEP

1572864:VHB4RbmpA55llCoXKeVNHGO3sKF5Qg0D4lqAN9/k6CXS2OTWR1V7cT:dmb5vlyez8K5hw4lqMVk6SS2FLYT

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2712	34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc.exe
2712	34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc.exe
2712	34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc.exe
2712	34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc.exe
2712	34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc.exe

C:\Users\Admin\AppData\Local\Temp\34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc.exe
"C:\Users\Admin\AppData\Local\Temp\34eaaad90bb4f33dedec3977d703b1af94476a2a8bf9a6dbdcd46ed5e88686dc.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso8A27.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
\Users\Admin\AppData\Local\Temp\nso8A27.tmp\ips_winver.dll

Filesize
33KB

MD5
16241e100df3561351ee760c69a81fb2

SHA1
df449d3d779a95f7c8780e657d8d120d9e0e5b97

SHA256
d30b2343b4c80ab3bb8e6f37b260e615a4d46378817c79444b22c10f5eca8a9e

SHA512
f93fd90d852da2a45932929014a50fab7169df819d4dc2468c2357957dfff97598d8414561396bc261c9f5b948e0068693048b3b1414384336c144f4e4605cbb

Download Submit