954eda918e240e4252d1d192614c2922b3b9cc16e1a26cc83417d362d55e8580

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 05:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

954eda918e240e4252d1d192614c2922b3b9cc16e1a26cc83417d362d55e8580.exe
Size

5.7MB
MD5

2267d055c9688c44f245a5547a311ee0
SHA1

35e5dc0655a8dad039766b0b15f11943f4938c68
SHA256

954eda918e240e4252d1d192614c2922b3b9cc16e1a26cc83417d362d55e8580
SHA512

ffa271971e3d4dedfdaf949f8d249a076650e48ce24a3f70b65a5a9e026c9ecfd884e4f7a8e26d41001a6fc0f635b07884b7c843b9262323ea1b6661f0436e8b
SSDEEP

98304:+xMoGklWkH0uqCQbN/sAzmGndc3NoueS14x8sxl+XCTwRXraIShbp7mVV:pkUkH0MQ5/sAzddEN7RExl+lRuIEbpKz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	954eda918e240e4252d1d192614c2922b3b9cc16e1a26cc83417d362d55e8580.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	954eda918e240e4252d1d192614c2922b3b9cc16e1a26cc83417d362d55e8580.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	954eda918e240e4252d1d192614c2922b3b9cc16e1a26cc83417d362d55e8580.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2372	954eda918e240e4252d1d192614c2922b3b9cc16e1a26cc83417d362d55e8580.exe
2372	954eda918e240e4252d1d192614c2922b3b9cc16e1a26cc83417d362d55e8580.exe

C:\Users\Admin\AppData\Local\Temp\954eda918e240e4252d1d192614c2922b3b9cc16e1a26cc83417d362d55e8580.exe
"C:\Users\Admin\AppData\Local\Temp\954eda918e240e4252d1d192614c2922b3b9cc16e1a26cc83417d362d55e8580.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads