Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 05:40
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
file.exe
-
Size
896KB
-
MD5
664cf41a62c7fbb7fc18a61807d85f71
-
SHA1
ab551aa18c83a8077497930b8b37e94db2d8311f
-
SHA256
008a9fa752bbd5a3928d15a4e010e006e91a7d27f5057def445d279da4e82822
-
SHA512
876fe6278b52ef33f7942789be44239f745201e2cd58ca49f7d0e6b28f21e8ef2fa0eabd0846a207d2ef0323d0273dfcb3db1ee84b8b33b8c22836269c2bd8b1
-
SSDEEP
12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTK:SqDEvCTbMWu7rQYlBQcBiT6rprG8asK
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe 1800 file.exe