c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe
Size

1.7MB
MD5

360581ae6aafd7cd8fd93487934bac7b
SHA1

01502bffa21f21591fedc3152385b6e4be2ad97f
SHA256

c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5
SHA512

b256fbe307bd2456f33c0a293d99e24f9157fc6f4408c0b1984e33c306f4c8569c64f0489999677458c814a4afca4bf0d26f5dcdec6ebd076a742973c1dc5136
SSDEEP

49152:vwREDcsqEwsyI5mnSq7HyvO9laEBv/x5BjNt:vwREIoVMSkCMasR/5t

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2704	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.tmp

Loads dropped DLL 1 IoCs

pid	Process
2128	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2704	2128	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe	30
PID 2128 wrote to memory of 2704	2128	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe	30
PID 2128 wrote to memory of 2704	2128	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe	30
PID 2128 wrote to memory of 2704	2128	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe	30
PID 2128 wrote to memory of 2704	2128	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe	30
PID 2128 wrote to memory of 2704	2128	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe	30
PID 2128 wrote to memory of 2704	2128	c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe	30

C:\Users\Admin\AppData\Local\Temp\c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe
"C:\Users\Admin\AppData\Local\Temp\c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\is-1PKOM.tmp\c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1PKOM.tmp\c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.tmp" /SL5="$30154,919552,919552,C:\Users\Admin\AppData\Local\Temp\c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-1PKOM.tmp\c72891dfe688ef9c92cfbe673c18ba0548266fd7015b1bb1f4c6fd4ecf3965e5.tmp

Filesize
2.8MB

MD5
3fb05a99f7087defa5df3dc946e68876

SHA1
de005a408c762509975db62b5bcfadf672ddfd0a

SHA256
43bf25266208ec2722fc0690c2610fbb531f528f35d4c97be2c679332ffd5f0a

SHA512
04d447d59836259c1ebb427060d02993197e8ffe8528b4841a367cea2aa523f072e4b123989dc50bb63ba08b5d3b0a5304dcacbdd4da1aab1e488fa31c6c1fda

Download Submit
memory/2128-0-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/2128-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/2128-10-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/2704-8-0x0000000000400000-0x00000000006D9000-memory.dmp

Filesize
2.8MB

Download
memory/2704-12-0x0000000000400000-0x00000000006D9000-memory.dmp

Filesize
2.8MB

Download
memory/2704-16-0x0000000000400000-0x00000000006D9000-memory.dmp

Filesize
2.8MB

Download
memory/2704-20-0x0000000000400000-0x00000000006D9000-memory.dmp

Filesize
2.8MB

Download
memory/2704-24-0x0000000000400000-0x00000000006D9000-memory.dmp

Filesize
2.8MB

Download
memory/2704-28-0x0000000000400000-0x00000000006D9000-memory.dmp

Filesize
2.8MB

Download
memory/2704-32-0x0000000000400000-0x00000000006D9000-memory.dmp

Filesize
2.8MB

Download
memory/2704-36-0x0000000000400000-0x00000000006D9000-memory.dmp

Filesize
2.8MB

Download