Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 00:11

General

  • Target

    9db80d7a17839a504186eb72675d0610N.exe

  • Size

    3.9MB

  • MD5

    9db80d7a17839a504186eb72675d0610

  • SHA1

    1706e1497197bcc9e59dab4acc8a7b3d607d525a

  • SHA256

    46eb8209dd54aad593c8f0b7db8bb7ded6028bedfd60ace2561e05885b2bde10

  • SHA512

    4aaf017f24ec6aa9bb14b08a999234682d2bdf683f5435e721c55c2d9a78eaa36c1aee59f31922feff2b458211fc0b0c82a1e1e11865255679c8f92d71eb59a4

  • SSDEEP

    3072:ZowahJ0y5iDe02mtTBf6NNFyxXA+33333333333333333333333333333333333C:YP5CeEtTB8FyxX0

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9db80d7a17839a504186eb72675d0610N.exe
    "C:\Users\Admin\AppData\Local\Temp\9db80d7a17839a504186eb72675d0610N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:116
  • C:\Program Files\Microsoft Explorer\svmssc.exe
    "C:\Program Files\Microsoft Explorer\svmssc.exe"
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Explorer\svmssc.exe

    Filesize

    18.4MB

    MD5

    541ae1162618a5bd503541f7807aa169

    SHA1

    32962d3f81efe3f6268c3af102f4f0cc531a7a12

    SHA256

    2a0942a5659afed23322eb5efb4b138c18c2f02b31f42824a35b36ab7efdfb2f

    SHA512

    ecab00d44cda3d46a4c7a3a6ca835ad10d4db21cb5a08b2844839c56e172c13274cfd5ed212c79a1316639611bb61e4b115a7aed033f5f6d540ec4adae18a707

  • C:\SystemTemp

    Filesize

    71B

    MD5

    501ee405233c8380a3337f715b52f236

    SHA1

    02428f67a123fdbb71cfe4b10db8686e4be24e80

    SHA256

    86a68180aff5c4a01d7c4c835c56e59f8bd7e51f5411ac48f80315beacaa8449

    SHA512

    6f39d482926027420429c39bee308e17002a65d19e54ee6d765b75b305631a4e1db78b3ee3b363e511d2f7fe4328d8738edcc55578be5476d3c8838b3831e99d