Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 02:51
Behavioral task
behavioral1
Sample
438fcfe5dd26dafe73cf7ed7b3d53a10N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
438fcfe5dd26dafe73cf7ed7b3d53a10N.exe
-
Size
4.6MB
-
MD5
438fcfe5dd26dafe73cf7ed7b3d53a10
-
SHA1
d99db22d96538a4fb4a2f1d6b7d844fa0fe3f167
-
SHA256
bc8e34ead7789473ef19471ac055bb29833e6696fb7a3abd28c1856e3494e327
-
SHA512
7964397527279aaa0911020d1742e640fb44c36bce4e1c45b06e3a812cfb0eea27559e2be693e29ca8ce80d89de11c9ebac1080d64352bb6bce3b92b0b471d2c
-
SSDEEP
98304:3dBB7BC14KpaYJ6Uh0ZS/hLdYaSptpOmNNUCgZlZ70opXUFTFOfnJHTWX0GQu98P:1kr/zhKSfefEigVe2T5NMyOD5q
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2536-0-0x0000000000D80000-0x00000000013F4000-memory.dmp upx behavioral1/memory/2536-47-0x0000000000D80000-0x00000000013F4000-memory.dmp upx behavioral1/memory/2536-57-0x0000000000D80000-0x00000000013F4000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe 2536 438fcfe5dd26dafe73cf7ed7b3d53a10N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\438fcfe5dd26dafe73cf7ed7b3d53a10N.exe"C:\Users\Admin\AppData\Local\Temp\438fcfe5dd26dafe73cf7ed7b3d53a10N.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2536