Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
08/09/2024, 03:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target file.exe
- Size 896KB
- Sample240908-ebmdfswdpd
- SHA256 8c18f5ca5e7e16d3ce9c9a72d8ca64c1c499971cddbf90433accbc984cbbf1e3
- MD5 4ed6f83c68ca6b46713e02a51e8cbb25
- SHA1 97bc2fca33a2195ff3d1a1f3a830b488b4edcec4
- SHA512 4f8cc94730434e98f9eba5ed9532c3d7745964027f016372bb41e505ab305b4aac8b135353a0f6d75bf40a557ae81ac3d785a78b63b499b78133033c58269c9c
- SSDEEP 12288:uqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaoTE:uqDEvCTbMWu7rQYlBQcBiT6rprG8awE
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe 2420 file.exe