Analysis
- max time kernel
149s - max time network
121s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
30/08/2024, 12:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target file.exe
- Size 896KB
- Sample240830-p6b63swepp
- SHA256 44226fc06be1caa4980a718a74aadc42f09269fb00016d2045e5e85cc7d68a39
- MD5 60f80cbc405b3d58c4580815283ddb51
- SHA1 415283faf584a69959e16d844326ad61a4cb2b98
- SHA512 7edda787b5895fcee1a1e32ccab92596b457d81b54bac26ecf85e6a900121bc2984c911dce415c6ef9ea10457aedd57bc1da99f8cbb7b43962e40b416fa4c621
- SSDEEP 12288:/qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTo:/qDEvCTbMWu7rQYlBQcBiT6rprG8aso
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe 2484 file.exe