Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 02:20

General

  • Target

    6ce4cbcc4370011b8a5efe2b4fa02be4.exe

  • Size

    984KB

  • MD5

    6ce4cbcc4370011b8a5efe2b4fa02be4

  • SHA1

    0be23e20e9799864c90f9a9fd62bf3eab51ebcbe

  • SHA256

    543e130ed81ebf5b59b928cad7d70c161386789a6856d19d90399d2712d6b629

  • SHA512

    f54b525894eb9360b55d3da561b7dba3ba1b94d71aa3939992c672320c068230e5b1d2799072d74e5f579b19a43e19811f4349d56fea8bc12f7b7143b1203b77

  • SSDEEP

    24576:Igh3EFrduBatrzlkhrvyIlbuan230quO7yFDN7F:IA34YonulvyIf2BpGF

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ce4cbcc4370011b8a5efe2b4fa02be4.exe
    "C:\Users\Admin\AppData\Local\Temp\6ce4cbcc4370011b8a5efe2b4fa02be4.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 568
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1484-0-0x0000000074341000-0x0000000074342000-memory.dmp

    Filesize

    4KB

  • memory/1484-1-0x0000000074340000-0x00000000748EB000-memory.dmp

    Filesize

    5.7MB

  • memory/1484-2-0x0000000074340000-0x00000000748EB000-memory.dmp

    Filesize

    5.7MB

  • memory/1484-3-0x0000000074340000-0x00000000748EB000-memory.dmp

    Filesize

    5.7MB

  • memory/1484-5-0x0000000074340000-0x00000000748EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2360-4-0x00000000005C0000-0x00000000005C1000-memory.dmp

    Filesize

    4KB