c9560a02caf769c474bfb1e4ab914f5224423c43bdf4c0886be9bce4b7c0308c

Analysis

max time kernel
15s
max time network
34s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2840680678d9edea64428e4993bebf10N.exe
Size

92KB
MD5

2840680678d9edea64428e4993bebf10
SHA1

707fd884572f998c2fab65abdea80070317f9550
SHA256

c9560a02caf769c474bfb1e4ab914f5224423c43bdf4c0886be9bce4b7c0308c
SHA512

2b0b8ea5dc8e181df55ec3c6d51c265ff8e97f930fdf71734ff90eba7e25fef7c8226a89756e2b74c04e984ac2a73d1baf2131eb6d4d23e617bbc22c9fbad43b
SSDEEP

768:HTi+9c8Yt+URHAJW7AQDdXHA7CCCCCCCCCCCCCCCCC07CCCCCCCCCCCCCCCCfCCB:HTRcXD1eJakLkc2AzNKGUwD

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2840680678d9edea64428e4993bebf10N.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	2840680678d9edea64428e4993bebf10N.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	2840680678d9edea64428e4993bebf10N.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	2840680678d9edea64428e4993bebf10N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2956	2840680678d9edea64428e4993bebf10N.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2956	2840680678d9edea64428e4993bebf10N.exe
2956	2840680678d9edea64428e4993bebf10N.exe
2956	2840680678d9edea64428e4993bebf10N.exe

C:\Users\Admin\AppData\Local\Temp\2840680678d9edea64428e4993bebf10N.exe
"C:\Users\Admin\AppData\Local\Temp\2840680678d9edea64428e4993bebf10N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-5-0x00000000054B0000-0x00000000058C2000-memory.dmp

Filesize
4.1MB

Download