Analysis
-
max time kernel
1199s -
max time network
839s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17-08-2024 17:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Recoil App.exe
Resource
win7-20240704-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral2
Sample
Recoil App.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
1200 seconds
General
-
Target
Recoil App.exe
-
Size
3.2MB
-
MD5
acf8907ce64638007fb5514265812c67
-
SHA1
daa5404df21afc0cbfc126b9544fa68f3833e3f8
-
SHA256
9fe5fb74600e204a4739a0ed262f16ab6c7eb9f970f61d6315a8e5010f9bc3d4
-
SHA512
aa7478af047621b9f6d828356a20905f46a520cf364bc639ff0c21b5e9ae8eb29d5edcb2dd00c4dc327ca5348868d754c7068aff132d27d21e606e3ff821f9b6
-
SSDEEP
49152:I6lJ8gDN56P1omLtSGq3dUDIGMGgaWwKUFK3l:ICWgWkXDGgaWwK9V
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Recoil App.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1880 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1880 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2028 Recoil App.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2028 Recoil App.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Recoil App.exe"C:\Users\Admin\AppData\Local\Temp\Recoil App.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2028
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1880