Analysis
- max time kernel
149s - max time network
119s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system - submitted
23/08/2024, 10:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target file.exe
- Size 896KB
- Sample240823-mbyeqa1bpn
- SHA256 115d42fde8c0fde6ade95a36fa29db55a2ba9fb1dcd105501fc39d0b6c1bf1fd
- MD5 300bfec6e18ed712d6127c83e577657a
- SHA1 844e28c788a2d9c232e330ad29558bfda47f5eb2
- SHA512 1f2606f3fb0cbebe0718d6175f83476c4732179802bf44f916852ed65f8b83cbef2b6e84d4eb014655761e6eb90dba0e1f99ed1d57e238fe5339b5077ee3f247
- SSDEEP 12288:UqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTU:UqDEvCTbMWu7rQYlBQcBiT6rprG8asU
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe 3012 file.exe