4b2199f2f2d847feb5d38804cc55cd7b3fdd67287abc490010e19c320d6dedce

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b2199f2f2d847feb5d38804cc55cd7b3fdd67287abc490010e19c320d6dedce.exe
Size

3.3MB
MD5

c98024550ea53a43bda0d82ceb5a92b8
SHA1

2532c9168613ba15c14210f48830ffb18698d456
SHA256

4b2199f2f2d847feb5d38804cc55cd7b3fdd67287abc490010e19c320d6dedce
SHA512

f4f9b9dcd2efe8845dae8a0ef06b2e076b956cdfc6bdf69372241097c49caf29b2b366d3a93cb3fdfff34de2aed541cc07f1eeeccb382754aa75480b33ee9d83
SSDEEP

98304:CJIf6AcfqubX/icxpaQbg3PWrjRaaroyGPy9:+IfsTj18roxsTPU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b2199f2f2d847feb5d38804cc55cd7b3fdd67287abc490010e19c320d6dedce.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	4b2199f2f2d847feb5d38804cc55cd7b3fdd67287abc490010e19c320d6dedce.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3016	4b2199f2f2d847feb5d38804cc55cd7b3fdd67287abc490010e19c320d6dedce.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3016	4b2199f2f2d847feb5d38804cc55cd7b3fdd67287abc490010e19c320d6dedce.exe
3016	4b2199f2f2d847feb5d38804cc55cd7b3fdd67287abc490010e19c320d6dedce.exe

C:\Users\Admin\AppData\Local\Temp\4b2199f2f2d847feb5d38804cc55cd7b3fdd67287abc490010e19c320d6dedce.exe
"C:\Users\Admin\AppData\Local\Temp\4b2199f2f2d847feb5d38804cc55cd7b3fdd67287abc490010e19c320d6dedce.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads