Analysis
- max time kernel
149s - max time network
121s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
02/09/2024, 05:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target file.exe
- Size 896KB
- Sample240902-frd8fstcnf
- SHA256 a013fd7b907a394a6d26eb1ea4f64d9cb7eff0e06910b4df0d8ae5c50b90be0e
- MD5 07f6819f9cbe9567538e67c64711f6a6
- SHA1 a1a6df3ff5d8ce6e36fe74fe2204a516d95768ef
- SHA512 e5b8946c22a2ddb8819ac1d8ae9b9173366b7d576f11072cabe57863388910ce24e0596c9ef2b429e05833ce70c0efd9e4a5588a3387cea8c37910749c1b141b
- SSDEEP 12288:pqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTO:pqDEvCTbMWu7rQYlBQcBiT6rprG8asO
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe 2236 file.exe