Analysis
-
max time kernel
53s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 20:37
Static task
static1
Behavioral task
behavioral1
Sample
Installer.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
Installer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
Installer.exe
-
Size
1.4MB
-
MD5
7eaaaa8fcc415db545f4cde72ad083c0
-
SHA1
9d294d1f61147dfe82cb30d8b6aa4c978ed3a609
-
SHA256
a105ae6db94ceb063d8e0019207bd08642d3d434a8217e3fe833b020bd6e6170
-
SHA512
cfff393947a65ba9f043bfbbddbeb4d2c4e8289a561f65f25c0294f7aa36367782b163ad9b19fe407beb2bfd9aec019b5cdb9293228552fc7a2a857316b774d5
-
SSDEEP
24576:byeIaZhac1XXDN0rKOWN8O3b0/3GhiIAzPU:b6StnDN0rKOWN8O3b0/3GhiIAzP
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2372 Installer.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Installer.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2708 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2708 taskmgr.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe -
Suspicious use of SendNotifyMessage 49 IoCs
pid Process 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe 2708 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2372
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
503KB
MD5639880dff7a53242f9d91f8a790ead09
SHA155795698202ca6b9712831234e9e10c99a2ec3b3
SHA256bd1751c666e41ca2bde9c2ffbb09b08acc9a5eb46ecfb0a028a258573911d881
SHA51222446fd4a0a0fc0a3101c63874db3fea2b8a91d30d53e20795a839fbcb37ca7da251fe618127fb619e7fd4d729383d98b8aed87105b10d9395c1166b8e2b6810