ee4dddc121bc3bedbf29be4e87a5605c92e24a1b0aa3bdcc3706fecc0efc3d18

Resubmissions

05-08-2024 13:11

240805-qeznqsxakq 3

Analysis

max time kernel
141s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NyanCat.exe
Size

39KB
MD5

8e6144471ac4f3b2b801830feca62657
SHA1

35e634809595f3100896979457810240ea5196df
SHA256

ee4dddc121bc3bedbf29be4e87a5605c92e24a1b0aa3bdcc3706fecc0efc3d18
SHA512

6a58c56c8b5a85d865908f583b88f331e8fdbba9f6ae0a5cd04dabe872318826083e3180d2abae71f755d47c43a3a500c1423adaf8d28dba897788f3ed3314b3
SSDEEP

384:mY4pwXzSSgFYJZwlVVkvwKwq6uMOOHVn2wcUFjuXk3W5xxxxxxxxxxxxxxxxxxkU:iSgDdOO12Qj0EZOOy2Qj0Bu

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NyanCat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	notepad.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe
1232	NyanCat.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2688	1232	NyanCat.exe	30
PID 1232 wrote to memory of 2688	1232	NyanCat.exe	30
PID 1232 wrote to memory of 2688	1232	NyanCat.exe	30
PID 1232 wrote to memory of 2688	1232	NyanCat.exe	30
PID 1232 wrote to memory of 2172	1232	NyanCat.exe	31
PID 1232 wrote to memory of 2172	1232	NyanCat.exe	31
PID 1232 wrote to memory of 2172	1232	NyanCat.exe	31
PID 1232 wrote to memory of 2172	1232	NyanCat.exe	31
PID 1232 wrote to memory of 2824	1232	NyanCat.exe	32
PID 1232 wrote to memory of 2824	1232	NyanCat.exe	32
PID 1232 wrote to memory of 2824	1232	NyanCat.exe	32
PID 1232 wrote to memory of 2824	1232	NyanCat.exe	32
PID 1232 wrote to memory of 2748	1232	NyanCat.exe	33
PID 1232 wrote to memory of 2748	1232	NyanCat.exe	33
PID 1232 wrote to memory of 2748	1232	NyanCat.exe	33
PID 1232 wrote to memory of 2748	1232	NyanCat.exe	33
PID 1232 wrote to memory of 2744	1232	NyanCat.exe	34
PID 1232 wrote to memory of 2744	1232	NyanCat.exe	34
PID 1232 wrote to memory of 2744	1232	NyanCat.exe	34
PID 1232 wrote to memory of 2744	1232	NyanCat.exe	34
PID 1232 wrote to memory of 3020	1232	NyanCat.exe	35
PID 1232 wrote to memory of 3020	1232	NyanCat.exe	35
PID 1232 wrote to memory of 3020	1232	NyanCat.exe	35
PID 1232 wrote to memory of 3020	1232	NyanCat.exe	35
PID 1232 wrote to memory of 2604	1232	NyanCat.exe	36
PID 1232 wrote to memory of 2604	1232	NyanCat.exe	36
PID 1232 wrote to memory of 2604	1232	NyanCat.exe	36
PID 1232 wrote to memory of 2604	1232	NyanCat.exe	36
PID 1232 wrote to memory of 3016	1232	NyanCat.exe	37
PID 1232 wrote to memory of 3016	1232	NyanCat.exe	37
PID 1232 wrote to memory of 3016	1232	NyanCat.exe	37
PID 1232 wrote to memory of 3016	1232	NyanCat.exe	37
PID 1232 wrote to memory of 2712	1232	NyanCat.exe	38
PID 1232 wrote to memory of 2712	1232	NyanCat.exe	38
PID 1232 wrote to memory of 2712	1232	NyanCat.exe	38
PID 1232 wrote to memory of 2712	1232	NyanCat.exe	38
PID 1232 wrote to memory of 2760	1232	NyanCat.exe	40
PID 1232 wrote to memory of 2760	1232	NyanCat.exe	40
PID 1232 wrote to memory of 2760	1232	NyanCat.exe	40
PID 1232 wrote to memory of 2760	1232	NyanCat.exe	40
PID 1232 wrote to memory of 2708	1232	NyanCat.exe	41
PID 1232 wrote to memory of 2708	1232	NyanCat.exe	41
PID 1232 wrote to memory of 2708	1232	NyanCat.exe	41
PID 1232 wrote to memory of 2708	1232	NyanCat.exe	41
PID 1232 wrote to memory of 2960	1232	NyanCat.exe	42
PID 1232 wrote to memory of 2960	1232	NyanCat.exe	42
PID 1232 wrote to memory of 2960	1232	NyanCat.exe	42
PID 1232 wrote to memory of 2960	1232	NyanCat.exe	42
PID 1232 wrote to memory of 2832	1232	NyanCat.exe	43
PID 1232 wrote to memory of 2832	1232	NyanCat.exe	43
PID 1232 wrote to memory of 2832	1232	NyanCat.exe	43
PID 1232 wrote to memory of 2832	1232	NyanCat.exe	43
PID 1232 wrote to memory of 2596	1232	NyanCat.exe	44
PID 1232 wrote to memory of 2596	1232	NyanCat.exe	44
PID 1232 wrote to memory of 2596	1232	NyanCat.exe	44
PID 1232 wrote to memory of 2596	1232	NyanCat.exe	44

C:\Users\Admin\AppData\Local\Temp\NyanCat.exe
"C:\Users\Admin\AppData\Local\Temp\NyanCat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2688
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2172
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2748
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2744
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3020
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2604
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2712
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2760
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2708
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2960
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-0-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/1232-1-0x00000000013E0000-0x00000000013F0000-memory.dmp

Filesize
64KB

Download
memory/1232-2-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/1232-3-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download