Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
23/08/2024, 12:11
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target file.exe
- Size 896KB
- Sample240823-pck7wsshkb
- SHA256 b1787fdef4283ff280276dedfade4495e880ecae949596654edf00976ce3f00f
- MD5 ba634ed8c1b0b3e688d89f185191f4db
- SHA1 0d000cbf959dd7733074f7c5877f6804dceff3e3
- SHA512 9bdd5022e3c63eb8f35df5b40d0726689b3a4b7fb9a7abd8a930fc0f633ee82dc428030cd6c2e0ed38654c6902b339fb27ad185345a43ffde620a6e417f3b900
- SSDEEP 12288:EqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTv:EqDEvCTbMWu7rQYlBQcBiT6rprG8asv
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe 1308 file.exe