db87b7e683d92aa8d013663c6bc6ba116023af2cb7f9ec6c2ad88694235f2b12

Analysis

max time kernel
135s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 07:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Document0081924.exe
Size 860KB
Sample240819-hwjd3stdrm
SHA256 db87b7e683d92aa8d013663c6bc6ba116023af2cb7f9ec6c2ad88694235f2b12
MD5 d14d08bd3c4c4e275b01b686dfe2448d
SHA1 da9e0cff3dcde54b71359eb4f982b3755359520f
SHA512 6b1d1c35ccf95d10ef4cb3c2731410d8721fad3a2f21e9a68fd8888d6754dc631df2e37133dcac66abd479278d36609d4e3d7cee0112517f6afb6f332defd7c8
SSDEEP 24576:4HH6h1Owng0/fXZocIcu0H6xyyjgDOYFc:I8q0/RBbueIXk
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3200 set thread context of 2128	3200	Document0081924.exe	96

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Document0081924.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3200	Document0081924.exe
3200	Document0081924.exe
3200	Document0081924.exe
3200	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe
2128	Document0081924.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	Document0081924.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3472	3200	Document0081924.exe	94
PID 3200 wrote to memory of 3472	3200	Document0081924.exe	94
PID 3200 wrote to memory of 3472	3200	Document0081924.exe	94
PID 3200 wrote to memory of 3132	3200	Document0081924.exe	95
PID 3200 wrote to memory of 3132	3200	Document0081924.exe	95
PID 3200 wrote to memory of 3132	3200	Document0081924.exe	95
PID 3200 wrote to memory of 2128	3200	Document0081924.exe	96
PID 3200 wrote to memory of 2128	3200	Document0081924.exe	96
PID 3200 wrote to memory of 2128	3200	Document0081924.exe	96
PID 3200 wrote to memory of 2128	3200	Document0081924.exe	96
PID 3200 wrote to memory of 2128	3200	Document0081924.exe	96
PID 3200 wrote to memory of 2128	3200	Document0081924.exe	96
PID 3200 wrote to memory of 2128	3200	Document0081924.exe	96
PID 3200 wrote to memory of 2128	3200	Document0081924.exe	96
PID 3200 wrote to memory of 2128	3200	Document0081924.exe	96
PID 3200 wrote to memory of 2128	3200	Document0081924.exe	96

C:\Users\Admin\AppData\Local\Temp\Document0081924.exe
"C:\Users\Admin\AppData\Local\Temp\Document0081924.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\Document0081924.exe
  "C:\Users\Admin\AppData\Local\Temp\Document0081924.exe"
  2⤵
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\Document0081924.exe
  "C:\Users\Admin\AppData\Local\Temp\Document0081924.exe"
  2⤵
  PID:3132
- C:\Users\Admin\AppData\Local\Temp\Document0081924.exe
  "C:\Users\Admin\AppData\Local\Temp\Document0081924.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-12-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2128-19-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2128-18-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2128-17-0x00000000029E0000-0x0000000002D2A000-memory.dmp

Download

memory/2128-14-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3200-4-0x00000000055F0000-0x00000000055FA000-memory.dmp

Download

memory/3200-6-0x00000000057E0000-0x00000000057F2000-memory.dmp

Download

memory/3200-7-0x000000007516E000-0x000000007516F000-memory.dmp

Download

memory/3200-8-0x0000000075160000-0x0000000075910000-memory.dmp

Download

memory/3200-9-0x0000000006770000-0x0000000006780000-memory.dmp

Download

memory/3200-10-0x00000000067C0000-0x0000000006858000-memory.dmp

Download

memory/3200-11-0x0000000006A60000-0x0000000006AFC000-memory.dmp

Download

memory/3200-5-0x0000000075160000-0x0000000075910000-memory.dmp

Download

memory/3200-0-0x000000007516E000-0x000000007516F000-memory.dmp

Download

memory/3200-16-0x0000000075160000-0x0000000075910000-memory.dmp

Download

memory/3200-3-0x0000000005530000-0x00000000055C2000-memory.dmp

Download

memory/3200-2-0x0000000005BC0000-0x0000000006164000-memory.dmp

Download

memory/3200-1-0x0000000000A80000-0x0000000000B5E000-memory.dmp

Download