f6c50c2fc5396da20a67cf22d63770562e9d3ab826fc34af3e41516aaf55cf36

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-09-2024 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6c50c2fc5396da20a67cf22d63770562e9d3ab826fc34af3e41516aaf55cf36.exe
Size

3.8MB
MD5

39f9b90b5dea841f0326cbfb8cc2874f
SHA1

f7b16ea424bd11c7d9a12cc589c056d8e84530a2
SHA256

f6c50c2fc5396da20a67cf22d63770562e9d3ab826fc34af3e41516aaf55cf36
SHA512

87e799b458c99a92c1e51bf3a9720c4391beeb08038e8bf0baeb81d8d672d3131c16a0b4749bbca2d58bc2438d9d26e91c0f6e586a445bcdf0b567d5bd223c6b
SSDEEP

98304:tYnHppu9gV89IFLrG3LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLp:gmgV89sLTqeWScgY

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\Eplay.ttf	f6c50c2fc5396da20a67cf22d63770562e9d3ab826fc34af3e41516aaf55cf36.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6c50c2fc5396da20a67cf22d63770562e9d3ab826fc34af3e41516aaf55cf36.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2676	f6c50c2fc5396da20a67cf22d63770562e9d3ab826fc34af3e41516aaf55cf36.exe
2676	f6c50c2fc5396da20a67cf22d63770562e9d3ab826fc34af3e41516aaf55cf36.exe

C:\Users\Admin\AppData\Local\Temp\f6c50c2fc5396da20a67cf22d63770562e9d3ab826fc34af3e41516aaf55cf36.exe
"C:\Users\Admin\AppData\Local\Temp\f6c50c2fc5396da20a67cf22d63770562e9d3ab826fc34af3e41516aaf55cf36.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Fonts\Eplay.ttf

Filesize
131B

MD5
07f5177ca4bc7106f935fceda5d71aa7

SHA1
541857854e5e869af5ae4f620f342035504f4ef7

SHA256
355aaea256c1032a7db45871ac58799c53e8877376c4d40e4dac69c72b97b7b8

SHA512
4075abb5258e7da5777913aecfe6d8a12f88433ccef43cf66962b3ae4d246c8b6f98caa4c621eabde3ae25990a2bafde2a0dd16a8eccacdec624d2fe5d1fa7b3

Download Submit
memory/2676-7-0x0000000003C20000-0x0000000003C21000-memory.dmp

Filesize
4KB

Download
memory/2676-6-0x0000000003C20000-0x0000000003C21000-memory.dmp

Filesize
4KB

Download
memory/2676-8-0x0000000003C20000-0x0000000003C21000-memory.dmp

Filesize
4KB

Download
memory/2676-9-0x0000000003C20000-0x0000000003C21000-memory.dmp

Filesize
4KB

Download