Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 22:23
Behavioral task
behavioral1
Sample
39aa7603363f94770e9e7c579b331e60N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
39aa7603363f94770e9e7c579b331e60N.exe
-
Size
4.6MB
-
MD5
39aa7603363f94770e9e7c579b331e60
-
SHA1
9be5d96856f3578b9d450f1497ce17a1b1819962
-
SHA256
8d5e2b05d39eb04b3c9c3f00bd9b2072db809483ae15017976adf6212988fa43
-
SHA512
d1bc9df1c31831501ee369f2fe26fece4811a90522a465cc0334771a08a8b2f81c8c246cc658c4edd54717aef55303fd8f6108a902b8e020c9df0f65f4156f2d
-
SSDEEP
98304:3dBB7BC14KpaYJ6Uh0ZS/hLdYaSptpOmNNUCgZlZ70opXUFTFOfnJHTWX0GQu98p:1kr/zhKSfefEigVe2T5NMyOD5U
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1632-0-0x0000000000C80000-0x00000000012F4000-memory.dmp upx behavioral1/memory/1632-47-0x0000000000C80000-0x00000000012F4000-memory.dmp upx behavioral1/memory/1632-57-0x0000000000C80000-0x00000000012F4000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39aa7603363f94770e9e7c579b331e60N.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main 39aa7603363f94770e9e7c579b331e60N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe 1632 39aa7603363f94770e9e7c579b331e60N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39aa7603363f94770e9e7c579b331e60N.exe"C:\Users\Admin\AppData\Local\Temp\39aa7603363f94770e9e7c579b331e60N.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1632