46eb8209dd54aad593c8f0b7db8bb7ded6028bedfd60ace2561e05885b2bde10

Analysis

max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9db80d7a17839a504186eb72675d0610N.exe
Size

3.9MB
MD5

9db80d7a17839a504186eb72675d0610
SHA1

1706e1497197bcc9e59dab4acc8a7b3d607d525a
SHA256

46eb8209dd54aad593c8f0b7db8bb7ded6028bedfd60ace2561e05885b2bde10
SHA512

4aaf017f24ec6aa9bb14b08a999234682d2bdf683f5435e721c55c2d9a78eaa36c1aee59f31922feff2b458211fc0b0c82a1e1e11865255679c8f92d71eb59a4
SSDEEP

3072:ZowahJ0y5iDe02mtTBf6NNFyxXA+33333333333333333333333333333333333C:YP5CeEtTB8FyxX0

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1828	svmssc.exe

Executes dropped EXE 1 IoCs

pid	Process
1828	svmssc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Explorer\svmssc.exe	9db80d7a17839a504186eb72675d0610N.exe
File opened for modification	C:\Program Files\Microsoft Explorer	9db80d7a17839a504186eb72675d0610N.exe
File created	C:\Program Files\Microsoft Explorer\svmssc.exe	9db80d7a17839a504186eb72675d0610N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9db80d7a17839a504186eb72675d0610N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svmssc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
116	9db80d7a17839a504186eb72675d0610N.exe
1828	svmssc.exe

C:\Users\Admin\AppData\Local\Temp\9db80d7a17839a504186eb72675d0610N.exe
"C:\Users\Admin\AppData\Local\Temp\9db80d7a17839a504186eb72675d0610N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:116

C:\Program Files\Microsoft Explorer\svmssc.exe
"C:\Program Files\Microsoft Explorer\svmssc.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Explorer\svmssc.exe

Filesize
18.4MB

MD5
541ae1162618a5bd503541f7807aa169

SHA1
32962d3f81efe3f6268c3af102f4f0cc531a7a12

SHA256
2a0942a5659afed23322eb5efb4b138c18c2f02b31f42824a35b36ab7efdfb2f

SHA512
ecab00d44cda3d46a4c7a3a6ca835ad10d4db21cb5a08b2844839c56e172c13274cfd5ed212c79a1316639611bb61e4b115a7aed033f5f6d540ec4adae18a707

Download Submit
C:\SystemTemp

Filesize
71B

MD5
501ee405233c8380a3337f715b52f236

SHA1
02428f67a123fdbb71cfe4b10db8686e4be24e80

SHA256
86a68180aff5c4a01d7c4c835c56e59f8bd7e51f5411ac48f80315beacaa8449

SHA512
6f39d482926027420429c39bee308e17002a65d19e54ee6d765b75b305631a4e1db78b3ee3b363e511d2f7fe4328d8738edcc55578be5476d3c8838b3831e99d

Download Submit