660838f6126d686ba5940e45884e2262212e0bfe6862c1006a5b3d2544f515b6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81a648162e9d980809aba735a7c2dbb0N.exe
Size

75KB
MD5

81a648162e9d980809aba735a7c2dbb0
SHA1

017ff37c04e8ad408fe5f2e4332123a395ff53ef
SHA256

660838f6126d686ba5940e45884e2262212e0bfe6862c1006a5b3d2544f515b6
SHA512

cac1d5fed2641fe919cee6c73a578150940aa875bad62c345e8820130144b81c6984288ec7499991804a8d3eac4bbb17ba2073a9576264508a2282b4c82d59fe
SSDEEP

1536:rGhiYDxU44/uFu+vwetfuNuqt7eoqPQX5Ptq516G8brqKHCQ1NfnfLxdC/u7RV9Y:ryiY9U44/uFu+vwsfuNRt7eo/5P816GD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81a648162e9d980809aba735a7c2dbb0N.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	81a648162e9d980809aba735a7c2dbb0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2100	81a648162e9d980809aba735a7c2dbb0N.exe

Suspicious behavior: MapViewOfSection 23 IoCs

pid	Process
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe
2100	81a648162e9d980809aba735a7c2dbb0N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	81a648162e9d980809aba735a7c2dbb0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 380	2100	81a648162e9d980809aba735a7c2dbb0N.exe	3
PID 2100 wrote to memory of 380	2100	81a648162e9d980809aba735a7c2dbb0N.exe	3
PID 2100 wrote to memory of 380	2100	81a648162e9d980809aba735a7c2dbb0N.exe	3
PID 2100 wrote to memory of 380	2100	81a648162e9d980809aba735a7c2dbb0N.exe	3
PID 2100 wrote to memory of 380	2100	81a648162e9d980809aba735a7c2dbb0N.exe	3
PID 2100 wrote to memory of 380	2100	81a648162e9d980809aba735a7c2dbb0N.exe	3
PID 2100 wrote to memory of 380	2100	81a648162e9d980809aba735a7c2dbb0N.exe	3
PID 2100 wrote to memory of 388	2100	81a648162e9d980809aba735a7c2dbb0N.exe	4
PID 2100 wrote to memory of 388	2100	81a648162e9d980809aba735a7c2dbb0N.exe	4
PID 2100 wrote to memory of 388	2100	81a648162e9d980809aba735a7c2dbb0N.exe	4
PID 2100 wrote to memory of 388	2100	81a648162e9d980809aba735a7c2dbb0N.exe	4
PID 2100 wrote to memory of 388	2100	81a648162e9d980809aba735a7c2dbb0N.exe	4
PID 2100 wrote to memory of 388	2100	81a648162e9d980809aba735a7c2dbb0N.exe	4
PID 2100 wrote to memory of 388	2100	81a648162e9d980809aba735a7c2dbb0N.exe	4
PID 2100 wrote to memory of 428	2100	81a648162e9d980809aba735a7c2dbb0N.exe	5
PID 2100 wrote to memory of 428	2100	81a648162e9d980809aba735a7c2dbb0N.exe	5
PID 2100 wrote to memory of 428	2100	81a648162e9d980809aba735a7c2dbb0N.exe	5
PID 2100 wrote to memory of 428	2100	81a648162e9d980809aba735a7c2dbb0N.exe	5
PID 2100 wrote to memory of 428	2100	81a648162e9d980809aba735a7c2dbb0N.exe	5
PID 2100 wrote to memory of 428	2100	81a648162e9d980809aba735a7c2dbb0N.exe	5
PID 2100 wrote to memory of 428	2100	81a648162e9d980809aba735a7c2dbb0N.exe	5
PID 2100 wrote to memory of 472	2100	81a648162e9d980809aba735a7c2dbb0N.exe	6
PID 2100 wrote to memory of 472	2100	81a648162e9d980809aba735a7c2dbb0N.exe	6
PID 2100 wrote to memory of 472	2100	81a648162e9d980809aba735a7c2dbb0N.exe	6
PID 2100 wrote to memory of 472	2100	81a648162e9d980809aba735a7c2dbb0N.exe	6
PID 2100 wrote to memory of 472	2100	81a648162e9d980809aba735a7c2dbb0N.exe	6
PID 2100 wrote to memory of 472	2100	81a648162e9d980809aba735a7c2dbb0N.exe	6
PID 2100 wrote to memory of 472	2100	81a648162e9d980809aba735a7c2dbb0N.exe	6
PID 2100 wrote to memory of 488	2100	81a648162e9d980809aba735a7c2dbb0N.exe	7
PID 2100 wrote to memory of 488	2100	81a648162e9d980809aba735a7c2dbb0N.exe	7
PID 2100 wrote to memory of 488	2100	81a648162e9d980809aba735a7c2dbb0N.exe	7
PID 2100 wrote to memory of 488	2100	81a648162e9d980809aba735a7c2dbb0N.exe	7
PID 2100 wrote to memory of 488	2100	81a648162e9d980809aba735a7c2dbb0N.exe	7
PID 2100 wrote to memory of 488	2100	81a648162e9d980809aba735a7c2dbb0N.exe	7
PID 2100 wrote to memory of 488	2100	81a648162e9d980809aba735a7c2dbb0N.exe	7
PID 2100 wrote to memory of 496	2100	81a648162e9d980809aba735a7c2dbb0N.exe	8
PID 2100 wrote to memory of 496	2100	81a648162e9d980809aba735a7c2dbb0N.exe	8
PID 2100 wrote to memory of 496	2100	81a648162e9d980809aba735a7c2dbb0N.exe	8
PID 2100 wrote to memory of 496	2100	81a648162e9d980809aba735a7c2dbb0N.exe	8
PID 2100 wrote to memory of 496	2100	81a648162e9d980809aba735a7c2dbb0N.exe	8
PID 2100 wrote to memory of 496	2100	81a648162e9d980809aba735a7c2dbb0N.exe	8
PID 2100 wrote to memory of 496	2100	81a648162e9d980809aba735a7c2dbb0N.exe	8
PID 2100 wrote to memory of 604	2100	81a648162e9d980809aba735a7c2dbb0N.exe	9
PID 2100 wrote to memory of 604	2100	81a648162e9d980809aba735a7c2dbb0N.exe	9
PID 2100 wrote to memory of 604	2100	81a648162e9d980809aba735a7c2dbb0N.exe	9
PID 2100 wrote to memory of 604	2100	81a648162e9d980809aba735a7c2dbb0N.exe	9
PID 2100 wrote to memory of 604	2100	81a648162e9d980809aba735a7c2dbb0N.exe	9
PID 2100 wrote to memory of 604	2100	81a648162e9d980809aba735a7c2dbb0N.exe	9
PID 2100 wrote to memory of 604	2100	81a648162e9d980809aba735a7c2dbb0N.exe	9
PID 2100 wrote to memory of 684	2100	81a648162e9d980809aba735a7c2dbb0N.exe	10
PID 2100 wrote to memory of 684	2100	81a648162e9d980809aba735a7c2dbb0N.exe	10
PID 2100 wrote to memory of 684	2100	81a648162e9d980809aba735a7c2dbb0N.exe	10
PID 2100 wrote to memory of 684	2100	81a648162e9d980809aba735a7c2dbb0N.exe	10
PID 2100 wrote to memory of 684	2100	81a648162e9d980809aba735a7c2dbb0N.exe	10
PID 2100 wrote to memory of 684	2100	81a648162e9d980809aba735a7c2dbb0N.exe	10
PID 2100 wrote to memory of 684	2100	81a648162e9d980809aba735a7c2dbb0N.exe	10
PID 2100 wrote to memory of 756	2100	81a648162e9d980809aba735a7c2dbb0N.exe	11
PID 2100 wrote to memory of 756	2100	81a648162e9d980809aba735a7c2dbb0N.exe	11
PID 2100 wrote to memory of 756	2100	81a648162e9d980809aba735a7c2dbb0N.exe	11
PID 2100 wrote to memory of 756	2100	81a648162e9d980809aba735a7c2dbb0N.exe	11
PID 2100 wrote to memory of 756	2100	81a648162e9d980809aba735a7c2dbb0N.exe	11
PID 2100 wrote to memory of 756	2100	81a648162e9d980809aba735a7c2dbb0N.exe	11
PID 2100 wrote to memory of 756	2100	81a648162e9d980809aba735a7c2dbb0N.exe	11
PID 2100 wrote to memory of 820	2100	81a648162e9d980809aba735a7c2dbb0N.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:472
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:604
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1312
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:636
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:684
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1156
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:864
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:972
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:236
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:284
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1072
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1108
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1060
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2560
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2460
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:388

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\81a648162e9d980809aba735a7c2dbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\81a648162e9d980809aba735a7c2dbb0N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2100-1-0x000000007708F000-0x0000000077090000-memory.dmp

Filesize
4KB

Download
memory/2100-4-0x0000000077090000-0x0000000077091000-memory.dmp

Filesize
4KB

Download
memory/2100-3-0x000000007708F000-0x0000000077090000-memory.dmp

Filesize
4KB

Download
memory/2100-2-0x0000000077090000-0x0000000077091000-memory.dmp

Filesize
4KB

Download
memory/2100-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download