adace1440cadccb294baf43f0a8ac1f1bd387b3082e0fd860f02071e8914e654

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adace1440cadccb294baf43f0a8ac1f1bd387b3082e0fd860f02071e8914e654.exe
Size

8.8MB
MD5

fa48e2917ce9ecee071f246381dafa46
SHA1

a85fd19de5dbd1075a0e3db0a37ba09a45c365c3
SHA256

adace1440cadccb294baf43f0a8ac1f1bd387b3082e0fd860f02071e8914e654
SHA512

261b017e42475b768d53a24cc60204a8be0474bf12bae3a46935d66dd499e7de18bcc151e76a606e157537fcab886893868c27dd87a29e01db2c9234d6b4de94
SSDEEP

196608:cVBznX3n0Ug7WYYH78aX3HQ2HBcBN2Ns444Fj2J0aGDZyDK+dUaZSU5i/mtf5vzC:crkl678WHQYcB4Ns44e2J0aG1IdUASe2

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2056	adace1440cadccb294baf43f0a8ac1f1bd387b3082e0fd860f02071e8914e654.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adace1440cadccb294baf43f0a8ac1f1bd387b3082e0fd860f02071e8914e654.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	adace1440cadccb294baf43f0a8ac1f1bd387b3082e0fd860f02071e8914e654.exe

C:\Users\Admin\AppData\Local\Temp\adace1440cadccb294baf43f0a8ac1f1bd387b3082e0fd860f02071e8914e654.exe
"C:\Users\Admin\AppData\Local\Temp\adace1440cadccb294baf43f0a8ac1f1bd387b3082e0fd860f02071e8914e654.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst737C.tmp\nsDialogs.dll

Filesize
9KB

MD5
b7d61f3f56abf7b7ff0d4e7da3ad783d

SHA1
15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

SHA256
89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

SHA512
6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

Download Submit