Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
96ec92b44fcb6509faee45c5a11ef99dcda885e88d9ed69d4e7273630cebed15.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
96ec92b44fcb6509faee45c5a11ef99dcda885e88d9ed69d4e7273630cebed15.exe
Resource
win10v2004-20240802-en
General
-
Target
96ec92b44fcb6509faee45c5a11ef99dcda885e88d9ed69d4e7273630cebed15.exe
-
Size
1.0MB
-
MD5
4478373f79c20ae0a36fa8ffb06b0186
-
SHA1
61a89256860350ac93e45b144e91f6ffbcbd23c4
-
SHA256
96ec92b44fcb6509faee45c5a11ef99dcda885e88d9ed69d4e7273630cebed15
-
SHA512
176844ee835d2441c85b1621e36ded7f8adff5595cdca366879751382b8a2af447a671f127ec7273d51b308b44c4b792109afcb85cc64f23ef6ea3c6e8126772
-
SSDEEP
24576:U4XKNzipIKjYQ/flNMwMsIkysAsXtoLFloEZ:U4/iK8MlK5kyb6tgFW6
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96ec92b44fcb6509faee45c5a11ef99dcda885e88d9ed69d4e7273630cebed15.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 648 96ec92b44fcb6509faee45c5a11ef99dcda885e88d9ed69d4e7273630cebed15.exe 648 96ec92b44fcb6509faee45c5a11ef99dcda885e88d9ed69d4e7273630cebed15.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96ec92b44fcb6509faee45c5a11ef99dcda885e88d9ed69d4e7273630cebed15.exe"C:\Users\Admin\AppData\Local\Temp\96ec92b44fcb6509faee45c5a11ef99dcda885e88d9ed69d4e7273630cebed15.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:648