Overview
overview
4Static
static
3Inkecn.exe
windows7-x64
3Inkecn.exe
windows10-2004-x64
3Update.exe
windows7-x64
3Update.exe
windows10-2004-x64
3icon/新云软件.url
windows7-x64
1icon/新云软件.url
windows10-2004-x64
1pic/make/�....0.doc
windows7-x64
4pic/make/�....0.doc
windows10-2004-x64
1大众印�....0.doc
windows7-x64
4大众印�....0.doc
windows10-2004-x64
1Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 22:34
Static task
static1
Behavioral task
behavioral1
Sample
Inkecn.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Inkecn.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Update.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Update.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
icon/新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
icon/新云软件.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
pic/make/大众印客精灵-使用说明V1.0.0.doc
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
pic/make/大众印客精灵-使用说明V1.0.0.doc
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
大众印客精灵-使用说明V1.0.0.doc
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
大众印客精灵-使用说明V1.0.0.doc
Resource
win10v2004-20240802-en
General
-
Target
Inkecn.exe
-
Size
2.6MB
-
MD5
229c33c06fa8ccf42128af20d1dc79c7
-
SHA1
668d3766c6ee9cf020735f6bff08328c5fb9531d
-
SHA256
aae0645585228afe15e69324fd6bb9b48f755a9fb0fbac6d54397f8d9ee6237b
-
SHA512
dc48cc185874048232d79b3a1f41fe6f046a3203a0e879ce3c55a3c854d2b2e318a35038cdc4fd3f18b8489336bef0bfc0e64849846975a470020d673dcbe950
-
SSDEEP
49152:Oc9yG1fFh+R94KGCJkEypjbFf4bSZDZv7ibMuQKsnsnMF2PyrQDk8wDWj5vKnw:3EG4R6x3blMSJl7ibMhrnsnMFBrQDk8H
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Inkecn.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2872 Inkecn.exe 2872 Inkecn.exe 2872 Inkecn.exe 2872 Inkecn.exe 2872 Inkecn.exe