1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b

Analysis

max time kernel
141s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b.exe
Size

205KB
MD5

233cf679b12d3c79c425713cd63c08c9
SHA1

3bc3ae98fc368127f5f2571b51065a53c8d831b5
SHA256

1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b
SHA512

9b26ec8999e2dd28571a18d50e95f0a4f1f80dfe5dd037dc320a0170239aae1b2f5938ee47c32e5b51081bd4579cc3e6b8aaf68fe2d056e600a0d6e922c36489
SSDEEP

3072:D5Bl3N4JJal79aX3LnbViY+vtkUsCnmh4uc25Bmmbd3f8Z6xDmNN8+k:D5BgvadeLnJiYZ+up5BmmbaWmNNe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3716	1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b.exe
3716	1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b.exe
3716	1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 1452	3716	1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b.exe	85
PID 3716 wrote to memory of 1452	3716	1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b.exe	85

C:\Users\Admin\AppData\Local\Temp\1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b.exe
"C:\Users\Admin\AppData\Local\Temp\1ce5fad50f9c4e202edf258bb5f718e2c91c670446fe523d5ee7ee326aac406b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-0-0x0000000001000000-0x0000000001037000-memory.dmp

Filesize
220KB

Download
memory/3716-1-0x0000000001000000-0x0000000001037000-memory.dmp

Filesize
220KB

Download