Analysis

  • max time kernel
    102s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 06:56

General

  • Target

    7a71f59d2ca32497a08d0cf9f05790d0N.exe

  • Size

    1.4MB

  • MD5

    7a71f59d2ca32497a08d0cf9f05790d0

  • SHA1

    2f274237030fbc41a94caa92c218e604b4215b4b

  • SHA256

    547c316e16556fca838a6cc40bfe9b3906e5301a69b0f577946e031564ee59be

  • SHA512

    ea607b8c1942f2729d268b64ac758be52677407cc4310a7b03d843fc9ccfab9caf983dd08c79762566cf949afe05ba0702fd47e3236173ab72eab7e48074bfcc

  • SSDEEP

    24576:v507EhRrX6eiWQ8G4qLfaTI7qJDlF8KqdjY4VzXIW1TLGdnaoXMRMQf:h0Eip85MfaTImb0EQzXn1yaSIMk

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a71f59d2ca32497a08d0cf9f05790d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\7a71f59d2ca32497a08d0cf9f05790d0N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\7a71f59d2ca32497a08d0cf9f05790d0N.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1808

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1808-3-0x000001CF5FAE0000-0x000001CF5FD50000-memory.dmp

          Filesize

          2.4MB

        • memory/1808-20-0x000001CF5E2F0000-0x000001CF5E2F1000-memory.dmp

          Filesize

          4KB

        • memory/1808-22-0x000001CF5FD50000-0x000001CF5FD60000-memory.dmp

          Filesize

          64KB

        • memory/1808-24-0x000001CF5FD60000-0x000001CF5FD70000-memory.dmp

          Filesize

          64KB

        • memory/1808-26-0x000001CF5FD70000-0x000001CF5FD80000-memory.dmp

          Filesize

          64KB

        • memory/1808-29-0x000001CF5FD80000-0x000001CF5FD90000-memory.dmp

          Filesize

          64KB

        • memory/1808-30-0x000001CF5FD90000-0x000001CF5FDA0000-memory.dmp

          Filesize

          64KB

        • memory/1808-33-0x000001CF5FDA0000-0x000001CF5FDB0000-memory.dmp

          Filesize

          64KB

        • memory/1808-34-0x000001CF5FDB0000-0x000001CF5FDC0000-memory.dmp

          Filesize

          64KB

        • memory/1808-37-0x000001CF5FDC0000-0x000001CF5FDD0000-memory.dmp

          Filesize

          64KB

        • memory/1808-39-0x000001CF5FDD0000-0x000001CF5FDE0000-memory.dmp

          Filesize

          64KB

        • memory/1808-38-0x000001CF5FAE0000-0x000001CF5FD50000-memory.dmp

          Filesize

          2.4MB

        • memory/1808-44-0x000001CF5FD50000-0x000001CF5FD60000-memory.dmp

          Filesize

          64KB

        • memory/1808-43-0x000001CF5FDF0000-0x000001CF5FE00000-memory.dmp

          Filesize

          64KB

        • memory/1808-42-0x000001CF5FDE0000-0x000001CF5FDF0000-memory.dmp

          Filesize

          64KB

        • memory/1808-47-0x000001CF5FE00000-0x000001CF5FE10000-memory.dmp

          Filesize

          64KB

        • memory/1808-46-0x000001CF5FD60000-0x000001CF5FD70000-memory.dmp

          Filesize

          64KB

        • memory/1808-50-0x000001CF5FD70000-0x000001CF5FD80000-memory.dmp

          Filesize

          64KB

        • memory/1808-51-0x000001CF5FE10000-0x000001CF5FE20000-memory.dmp

          Filesize

          64KB

        • memory/1808-55-0x000001CF5FE20000-0x000001CF5FE30000-memory.dmp

          Filesize

          64KB

        • memory/1808-54-0x000001CF5FD90000-0x000001CF5FDA0000-memory.dmp

          Filesize

          64KB

        • memory/1808-53-0x000001CF5FD80000-0x000001CF5FD90000-memory.dmp

          Filesize

          64KB

        • memory/1808-60-0x000001CF5FDB0000-0x000001CF5FDC0000-memory.dmp

          Filesize

          64KB

        • memory/1808-59-0x000001CF5FDA0000-0x000001CF5FDB0000-memory.dmp

          Filesize

          64KB

        • memory/1808-58-0x000001CF5FE40000-0x000001CF5FE50000-memory.dmp

          Filesize

          64KB

        • memory/1808-62-0x000001CF5FE50000-0x000001CF5FE60000-memory.dmp

          Filesize

          64KB

        • memory/1808-57-0x000001CF5FE30000-0x000001CF5FE40000-memory.dmp

          Filesize

          64KB

        • memory/1808-66-0x000001CF5FE60000-0x000001CF5FE70000-memory.dmp

          Filesize

          64KB

        • memory/1808-65-0x000001CF5FDC0000-0x000001CF5FDD0000-memory.dmp

          Filesize

          64KB

        • memory/1808-70-0x000001CF5FDD0000-0x000001CF5FDE0000-memory.dmp

          Filesize

          64KB

        • memory/1808-71-0x000001CF5FE70000-0x000001CF5FE80000-memory.dmp

          Filesize

          64KB

        • memory/1808-77-0x000001CF5FE80000-0x000001CF5FE90000-memory.dmp

          Filesize

          64KB

        • memory/1808-76-0x000001CF5FDF0000-0x000001CF5FE00000-memory.dmp

          Filesize

          64KB

        • memory/1808-75-0x000001CF5FDE0000-0x000001CF5FDF0000-memory.dmp

          Filesize

          64KB

        • memory/1808-80-0x000001CF5FE90000-0x000001CF5FEA0000-memory.dmp

          Filesize

          64KB

        • memory/1808-81-0x000001CF5FE00000-0x000001CF5FE10000-memory.dmp

          Filesize

          64KB

        • memory/1808-82-0x000001CF5FEA0000-0x000001CF5FEB0000-memory.dmp

          Filesize

          64KB

        • memory/1808-85-0x000001CF5FE10000-0x000001CF5FE20000-memory.dmp

          Filesize

          64KB

        • memory/1808-88-0x000001CF5FE20000-0x000001CF5FE30000-memory.dmp

          Filesize

          64KB

        • memory/1808-87-0x000001CF5FEC0000-0x000001CF5FED0000-memory.dmp

          Filesize

          64KB

        • memory/1808-86-0x000001CF5FEB0000-0x000001CF5FEC0000-memory.dmp

          Filesize

          64KB

        • memory/1808-91-0x000001CF5FE30000-0x000001CF5FE40000-memory.dmp

          Filesize

          64KB

        • memory/1808-93-0x000001CF5FED0000-0x000001CF5FEE0000-memory.dmp

          Filesize

          64KB

        • memory/1808-92-0x000001CF5FE40000-0x000001CF5FE50000-memory.dmp

          Filesize

          64KB

        • memory/1808-94-0x000001CF5FEE0000-0x000001CF5FEF0000-memory.dmp

          Filesize

          64KB

        • memory/1808-97-0x000001CF5E2F0000-0x000001CF5E2F1000-memory.dmp

          Filesize

          4KB

        • memory/1808-99-0x000001CF5FEF0000-0x000001CF5FF00000-memory.dmp

          Filesize

          64KB

        • memory/1808-98-0x000001CF5FE50000-0x000001CF5FE60000-memory.dmp

          Filesize

          64KB

        • memory/1808-102-0x000001CF5FE60000-0x000001CF5FE70000-memory.dmp

          Filesize

          64KB

        • memory/1808-104-0x000001CF5FE70000-0x000001CF5FE80000-memory.dmp

          Filesize

          64KB

        • memory/1808-105-0x000001CF5FE80000-0x000001CF5FE90000-memory.dmp

          Filesize

          64KB

        • memory/1808-106-0x000001CF5FE90000-0x000001CF5FEA0000-memory.dmp

          Filesize

          64KB

        • memory/1808-107-0x000001CF5FEA0000-0x000001CF5FEB0000-memory.dmp

          Filesize

          64KB

        • memory/1808-108-0x000001CF5FEB0000-0x000001CF5FEC0000-memory.dmp

          Filesize

          64KB

        • memory/1808-109-0x000001CF5FEC0000-0x000001CF5FED0000-memory.dmp

          Filesize

          64KB

        • memory/1808-110-0x000001CF5FED0000-0x000001CF5FEE0000-memory.dmp

          Filesize

          64KB

        • memory/1808-111-0x000001CF5FEE0000-0x000001CF5FEF0000-memory.dmp

          Filesize

          64KB

        • memory/1808-112-0x000001CF5FEF0000-0x000001CF5FF00000-memory.dmp

          Filesize

          64KB

        • memory/1808-114-0x000001CF5FF00000-0x000001CF5FF10000-memory.dmp

          Filesize

          64KB

        • memory/1808-115-0x000001CF5FF00000-0x000001CF5FF10000-memory.dmp

          Filesize

          64KB

        • memory/4976-0-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB