Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 09:35
Static task
static1
Behavioral task
behavioral1
Sample
bcfa313d04ce8d197c23b7de612b67676594aded8336b3b046120fb81c6baa1c.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
bcfa313d04ce8d197c23b7de612b67676594aded8336b3b046120fb81c6baa1c.exe
Resource
win10v2004-20240802-en
General
-
Target
bcfa313d04ce8d197c23b7de612b67676594aded8336b3b046120fb81c6baa1c.exe
-
Size
3.6MB
-
MD5
575820d33f5bd7ebbbab04f186d52b54
-
SHA1
b9f66f87e9cf92ede2e99852add1dd68bac98218
-
SHA256
bcfa313d04ce8d197c23b7de612b67676594aded8336b3b046120fb81c6baa1c
-
SHA512
f4a0d90a37e3c94cf3aefa8e19c492c706167211ce1e2f2403d07766b6e4e50651766379a111f60011fed2e73c2a49dc313464f93883ad590b9ba04cf84f42a8
-
SSDEEP
98304:FY5GCwNS9Gg0725He9J4HKuAf0s+OsgC8CAC4:rNS9GRDbluqxsi
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bcfa313d04ce8d197c23b7de612b67676594aded8336b3b046120fb81c6baa1c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1948 bcfa313d04ce8d197c23b7de612b67676594aded8336b3b046120fb81c6baa1c.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1948 bcfa313d04ce8d197c23b7de612b67676594aded8336b3b046120fb81c6baa1c.exe 1948 bcfa313d04ce8d197c23b7de612b67676594aded8336b3b046120fb81c6baa1c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcfa313d04ce8d197c23b7de612b67676594aded8336b3b046120fb81c6baa1c.exe"C:\Users\Admin\AppData\Local\Temp\bcfa313d04ce8d197c23b7de612b67676594aded8336b3b046120fb81c6baa1c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1948