Overview

overview

3

Static

static

3

Installer.exe

windows11-21h2-x64

3

Resubmissions

31-07-2024 15:05

240731-sf8zxazbjq 8

31-07-2024 15:04

240731-sft6ratgma 3

31-07-2024 15:04

240731-sfmrnszarm 3

31-07-2024 15:03

240731-se18nstgjb 3

31-07-2024 14:51

240731-r8c79syfll 8

31-07-2024 14:46

240731-r5qn7ayejj 3

31-07-2024 13:39

240731-qx27kszhpc 10

Analysis

  • max time kernel
    432s
  • max time network
    1155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240730-en
  • resource tags

    arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31-07-2024 15:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Installer.exe

  • Size

    1.1MB

  • MD5

    9819a03ffd0525dc2c67095ed032ee48

  • SHA1

    4d39fce7df80e6d8ed1d07670a614879dcf15695

  • SHA256

    74f36ce2089cea27236550f53c879258e279615c9815f905776fef84f4c4db81

  • SHA512

    336244a436c8f1a169f5a58c8c8e22f07a9fe877736b0d60781667fbe8e82ac8c72859dd0d096e2eb290fd10065af1ece22d80e778a363de924f55de32aa3966

  • SSDEEP

    24576:aw2nkacAuv0EkqjVnlqud+/2P+AlYOnet:aRnkr7nkqXfd+/9AlFne

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:916

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/916-0-0x00000000747CE000-0x00000000747CF000-memory.dmp
    Filesize

    4KB

    Download
  • memory/916-1-0x0000000000D40000-0x0000000000E52000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/916-2-0x0000000005FA0000-0x0000000006546000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/916-3-0x0000000005910000-0x00000000059A2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/916-4-0x0000000005AF0000-0x0000000005BA2000-memory.dmp
    Filesize

    712KB

    Download
  • memory/916-5-0x00000000747C0000-0x0000000074F71000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/916-6-0x0000000006DD0000-0x0000000006DF2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/916-7-0x0000000006F60000-0x0000000006F6A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/916-8-0x00000000747CE000-0x00000000747CF000-memory.dmp
    Filesize

    4KB

    Download
  • memory/916-9-0x00000000747C0000-0x0000000074F71000-memory.dmp
    Filesize

    7.7MB

    Download