Overview

overview

3

Static

static

3

Installer.exe

windows11-21h2-x64

3

Resubmissions

31-07-2024 15:05

240731-sf8zxazbjq 8

31-07-2024 15:04

240731-sft6ratgma 3

31-07-2024 15:04

240731-sfmrnszarm 3

31-07-2024 15:03

240731-se18nstgjb 3

31-07-2024 14:51

240731-r8c79syfll 8

31-07-2024 14:46

240731-r5qn7ayejj 3

31-07-2024 13:39

240731-qx27kszhpc 10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240730-en
  • resource tags

    arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31-07-2024 15:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Installer.exe

  • Size

    1.1MB

  • MD5

    9819a03ffd0525dc2c67095ed032ee48

  • SHA1

    4d39fce7df80e6d8ed1d07670a614879dcf15695

  • SHA256

    74f36ce2089cea27236550f53c879258e279615c9815f905776fef84f4c4db81

  • SHA512

    336244a436c8f1a169f5a58c8c8e22f07a9fe877736b0d60781667fbe8e82ac8c72859dd0d096e2eb290fd10065af1ece22d80e778a363de924f55de32aa3966

  • SSDEEP

    24576:aw2nkacAuv0EkqjVnlqud+/2P+AlYOnet:aRnkr7nkqXfd+/9AlFne

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:924

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/924-0-0x0000000074F2E000-0x0000000074F2F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/924-1-0x0000000000980000-0x0000000000A92000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/924-2-0x0000000005CA0000-0x0000000006246000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/924-3-0x00000000055D0000-0x0000000005662000-memory.dmp
    Filesize

    584KB

    Download
  • memory/924-4-0x00000000057F0000-0x00000000058A2000-memory.dmp
    Filesize

    712KB

    Download
  • memory/924-5-0x0000000074F20000-0x00000000756D1000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/924-6-0x0000000006A10000-0x0000000006A32000-memory.dmp
    Filesize

    136KB

    Download
  • memory/924-7-0x0000000006BA0000-0x0000000006BAA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/924-8-0x0000000074F2E000-0x0000000074F2F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/924-9-0x0000000074F20000-0x00000000756D1000-memory.dmp
    Filesize

    7.7MB

    Download