Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 00:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
573e4dd9ae6630d52702c4b9173b11c0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
573e4dd9ae6630d52702c4b9173b11c0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
120 seconds
General
-
Target
573e4dd9ae6630d52702c4b9173b11c0N.exe
-
Size
10KB
-
MD5
573e4dd9ae6630d52702c4b9173b11c0
-
SHA1
ab4b6e45d356ade72461faba5dbd5ec2a54ef7b6
-
SHA256
084d25f64a21c6312f06a66b9bf921289df5bdc36d878ddb2202808ebcfdfc65
-
SHA512
8c68554aedf5c9dc01f87cfc7b7f076cd912f22edacd27b888f145673e309b0ea9ad8feeccc031481b34201edbce5dc1afda9e1bd2bf12d83f04fd51885575be
-
SSDEEP
96:bk9Ma5eRnWnmLMddMWTtGC6T1VVNCGOfBraJkR+GpwGf9EgKepZyZ6bc9kdzNt:CynqmLidtECY18fVaaRxqGf9EZSytqX
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2356 1968 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 573e4dd9ae6630d52702c4b9173b11c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmstp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1248 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 30 PID 1968 wrote to memory of 1248 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 30 PID 1968 wrote to memory of 1248 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 30 PID 1968 wrote to memory of 1248 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 30 PID 1968 wrote to memory of 1248 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 30 PID 1968 wrote to memory of 1248 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 30 PID 1968 wrote to memory of 1248 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 30 PID 1968 wrote to memory of 2356 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 31 PID 1968 wrote to memory of 2356 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 31 PID 1968 wrote to memory of 2356 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 31 PID 1968 wrote to memory of 2356 1968 573e4dd9ae6630d52702c4b9173b11c0N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\573e4dd9ae6630d52702c4b9173b11c0N.exe"C:\Users\Admin\AppData\Local\Temp\573e4dd9ae6630d52702c4b9173b11c0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\windows\SysWOW64\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\rundll32.inf2⤵
- System Location Discovery: System Language Discovery
PID:1248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 6202⤵
- Program crash
PID:2356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664B
MD5b1fa15c3cb82b0a7684f4d3df4e2cd92
SHA1130600b696381df73414f608e927fb4e7680cbfd
SHA25665a54e2a08624eca8615a7e1077023e62aaf8d3a09b92dc6b84df06c7a0ba3c8
SHA512d96fd7f436c52aa1d1c86e8ae624e5220cd61903a912e4536642bcb5ae4d56a6f9c6e7c75aeb68c8a32056caec72ca4924bf443b66f46180ecd37fcb93fb72a5