32fec5f5a1e77d6fdb8b27016d70c923429b9530459850d8207c925e563dfe09

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_lossless_scaling_2.9.0.exe
Size

5.9MB
MD5

3f484fb41e85aa1875ab0e966a13fbff
SHA1

f2591e8c9e46520a10cbfbb4f80fa0cff1722701
SHA256

32fec5f5a1e77d6fdb8b27016d70c923429b9530459850d8207c925e563dfe09
SHA512

d761369016596a51a3a8c2ee8364f0608771e05c95517ac256126eb74a77ef5ff87e39949d33ce0c7b046ad7f642d6354513968842035e6206a974e8eca54b8d
SSDEEP

49152:kBuZrEUNBUJiQXPfoYV7hZiRZieAlA89hAnqQQDI7QPmJLJZ2iZ3vxm3c7ldk:6kLNAXXoYTZblA89hAqQsOQPCXvm3chG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1512	setup_lossless_scaling_2.9.0.tmp

Loads dropped DLL 1 IoCs

pid	Process
292	setup_lossless_scaling_2.9.0.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_lossless_scaling_2.9.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_lossless_scaling_2.9.0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1512	setup_lossless_scaling_2.9.0.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 292 wrote to memory of 1512	292	setup_lossless_scaling_2.9.0.exe	30
PID 292 wrote to memory of 1512	292	setup_lossless_scaling_2.9.0.exe	30
PID 292 wrote to memory of 1512	292	setup_lossless_scaling_2.9.0.exe	30
PID 292 wrote to memory of 1512	292	setup_lossless_scaling_2.9.0.exe	30
PID 292 wrote to memory of 1512	292	setup_lossless_scaling_2.9.0.exe	30
PID 292 wrote to memory of 1512	292	setup_lossless_scaling_2.9.0.exe	30
PID 292 wrote to memory of 1512	292	setup_lossless_scaling_2.9.0.exe	30

C:\Users\Admin\AppData\Local\Temp\setup_lossless_scaling_2.9.0.exe
"C:\Users\Admin\AppData\Local\Temp\setup_lossless_scaling_2.9.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:292
- C:\Users\Admin\AppData\Local\Temp\is-4M2C8.tmp\setup_lossless_scaling_2.9.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4M2C8.tmp\setup_lossless_scaling_2.9.0.tmp" /SL5="$5014E,5281693,844288,C:\Users\Admin\AppData\Local\Temp\setup_lossless_scaling_2.9.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-4M2C8.tmp\setup_lossless_scaling_2.9.0.tmp

Filesize
3.0MB

MD5
d7b514bf909e1e4d0f26a0595d3354ec

SHA1
88fd37a48fadb910a3a96d0e8c0b5ef559ab210d

SHA256
4e1ed66e3aa81ae7e561324d504088482c73f97fa2c0bccd59e83512b78b1259

SHA512
997bb2d23c217e1f7b589bd4440b26177a6d061b3406892368c5527f569283b56db0f6d48cb74f9a00c534ede50d05e19268e2b04fc28ec33cf5c5dcc87eb9de

Download Submit
memory/292-0-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/292-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/292-10-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/1512-8-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download
memory/1512-11-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download