9196c41c4e14f98f88e8751b9509c21a8bb297ea1f1c3a672619d2fb179ab669

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cvery.com/32bssx.exe
Size

770KB
MD5

373f1df557289456562deb5e0b423c9e
SHA1

26209be00a0ef1c0583f534089e6db032393627e
SHA256

d1f7ea61f9aa05a45ee955668794523bfd46aeb6556543403eb78dddcb96b8fd
SHA512

beb4780c6f85ab4f3a787bd705716e88a3e744bf3367480376c06033ac787b028b2b3ccea3c07e49f730d3284dfcc9081099fcbb05cd718df076310a118b9abf
SSDEEP

24576:gUhKphemL20wpL2l+TUWEIhUqNgPFfs9Dima9pofOCo:Vq80wpgcNEIhFgn8fOCo

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2840	INSTALL.EXE

Loads dropped DLL 4 IoCs

pid	Process
2736	32bssx.exe
2840	INSTALL.EXE
2840	INSTALL.EXE
2840	INSTALL.EXE

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32bssx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INSTALL.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2840	INSTALL.EXE
2840	INSTALL.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2840	2736	32bssx.exe	30
PID 2736 wrote to memory of 2840	2736	32bssx.exe	30
PID 2736 wrote to memory of 2840	2736	32bssx.exe	30
PID 2736 wrote to memory of 2840	2736	32bssx.exe	30
PID 2736 wrote to memory of 2840	2736	32bssx.exe	30
PID 2736 wrote to memory of 2840	2736	32bssx.exe	30
PID 2736 wrote to memory of 2840	2736	32bssx.exe	30

C:\Users\Admin\AppData\Local\Temp\cvery.com\32bssx.exe
"C:\Users\Admin\AppData\Local\Temp\cvery.com\32bssx.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\WZS7427.tmp\INSTALL.EXE
  INSTALL.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\WZS7427.tmp\INSTALL.EXE

Filesize
328KB

MD5
22c963af3685b908e0fe019c20976d46

SHA1
2ee70423dc64e2d090f5f89483fd4869e02c136b

SHA256
c709348be94dd34bb12814a0018981b81bd87373c7d50afaa92e4a827d4f929b

SHA512
68c18f3643ddd754fac87cc5ed3b660a9166cbc2137456241a28990db870f685481436d2b6888ab6679ce6ebfae8af179fca75ca3011ec7eb9962a343dfac953

Download Submit