a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4.exe
Size 14.1MB
Sample240907-zaex7swcpc
SHA256 a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4
MD5 a902264e59e85b37cd6da652ccb249cb
SHA1 8c33b1bf078e073ba1d95af768ee6a58edd1d88a
SHA512 381505c42c2df40da36e3d8d439c350b9d8977100291ae8bd2a033f9eb0b54b408cd4678b5c22a4c2c8a656a4b991b902373ef26fafc7598c5e7232b5ca78dac
SSDEEP 393216:qjIzYaUD7iS+o8VU4vLPNXV/Q+VhvR88FT5:HzhUqo8a4vLFF3VhvRzZ5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4468	a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4.exe
4468	a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4468	a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4468	a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4.exe

C:\Users\Admin\AppData\Local\Temp\a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4.exe
"C:\Users\Admin\AppData\Local\Temp\a08f992089a120d4e7c0899d48eb51d66503060f988739735dfc1d98aa9706f4.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

360Base.dll

Path C:\Users\Admin\AppData\Local\Temp\SysCleanPro\360Base.dll
Size 766KB
SHA256 526945bd0aca803139ea611dd2698a219846ea1f99d442ffd3aac6ae374619d7
MD5 f8c6e30aa708e867199a732cc46eb7bd
SHA1 803ae833a9563c6c93c706c05ec33310308ddc32
SHA512 c62dbc1a34a0e08e4eb6edb46d3b75ea43f752179f66fd6ef3672a8d0149b92bd3688dad23ece9d3a130998df42902b73b55d7d05c8e3fd2887ac2ca1a84b06f
SSDEEP 12288:meJYWlh9J2NWjm0GcKzFMmnHeFeZKcA/nStNS4tNT+dymqadF:jJYWlh9YNzlHHeFeJtIeT+dymdF
MD5 SHA1 SHA512 SSDEEP

Submit Download

sites.dll

Path C:\Users\Admin\AppData\Local\Temp\SysCleanPro\sites.dll
Size 1.4MB
SHA256 23d2b040f587a2823b2aa35a1de221fa485c78f2ba230a38913ba149a0458b5d
MD5 b6573421fa6713e7060af7298af28804
SHA1 59a58d8dec778c6937cf261f16a5ef3aad9de315
SHA512 431f1ecb1c269bddcc4466f0c60149cab0ea7684a58e0394fb5c80180a7eefa0476f0894c9371fb889e5f20e3487e03b534624e270dba1ce2cb70acbfa248336
SSDEEP 24576:8+u7GqRdD5Q110SwTUT48E7tlI5/Ig757WD2:i7vR0DWo4p7tlIhIg1Q2
MD5 SHA1 SHA512 SSDEEP