Overview
overview
3Static
static
3275620948/...e.html
windows7-x64
3275620948/...e.html
windows10-2004-x64
3275620948/...ug.htm
windows7-x64
3275620948/...ug.htm
windows10-2004-x64
3275620948/...se.exe
windows7-x64
3275620948/...se.exe
windows10-2004-x64
3275620948/...15.dll
windows7-x64
3275620948/...15.dll
windows10-2004-x64
3275620948/...se.exe
windows7-x64
3275620948/...se.exe
windows10-2004-x64
3275620948/...15.dll
windows7-x64
3275620948/...15.dll
windows10-2004-x64
3275620948/...e.html
windows7-x64
3275620948/...e.html
windows10-2004-x64
3275620948/...se.exe
windows7-x64
3275620948/...se.exe
windows10-2004-x64
3275620948/...15.dll
windows7-x64
3275620948/...15.dll
windows10-2004-x64
3275620948/...��.htm
windows7-x64
3275620948/...��.htm
windows10-2004-x64
3275620948/...��.htm
windows7-x64
3275620948/...��.htm
windows10-2004-x64
3275620948/...��.htm
windows7-x64
3275620948/...��.htm
windows10-2004-x64
3275620948/.../vt.js
windows7-x64
3275620948/.../vt.js
windows10-2004-x64
3275620948/...lt.vbs
windows7-x64
1275620948/...lt.vbs
windows10-2004-x64
1275620948/...aw.vbs
windows7-x64
1275620948/...aw.vbs
windows10-2004-x64
1275620948/...lay.js
windows7-x64
3275620948/...lay.js
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 11:33
Static task
static1
Behavioral task
behavioral1
Sample
275620948/Example/Example-DirectDraw/Example.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
275620948/Example/Example-DirectDraw/Example.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
275620948/Example/Example-DirectDraw/Run/Debug.htm
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
275620948/Example/Example-DirectDraw/Run/Debug.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
275620948/Example/Example-DirectDraw/Run/Example_release.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
275620948/Example/Example-DirectDraw/Run/Example_release.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
275620948/Example/Example-DirectDraw/Run/ijl15.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
275620948/Example/Example-DirectDraw/Run/ijl15.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
275620948/Example/Example-Graphics/Run/Example_Release.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
275620948/Example/Example-Graphics/Run/Example_Release.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
275620948/Example/Example-Graphics/Run/ijl15.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
275620948/Example/Example-Graphics/Run/ijl15.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
275620948/Example/Example-Media/Example.html
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
275620948/Example/Example-Media/Example.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
275620948/Example/Example-Media/Run/Example_release.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
275620948/Example/Example-Media/Run/Example_release.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
275620948/Example/Example-Media/Run/ijl15.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
275620948/Example/Example-Media/Run/ijl15.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
275620948/HoHo/Document/HoHoQA/常见问题-问与答.htm
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
275620948/HoHo/Document/HoHoQA/常见问题-问与答.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
275620948/HoHo/Document/HoHoSys/2D图像绘制操作指南.htm
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
275620948/HoHo/Document/HoHoSys/2D图像绘制操作指南.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
275620948/HoHo/Document/Install/VC.Net下的安装.htm
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
275620948/HoHo/Document/Install/VC.Net下的安装.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
275620948/HoHo/Document/vt.js
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
275620948/HoHo/Document/vt.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
275620948/HoHo/Graphics/Blt.vbs
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
275620948/HoHo/Graphics/Blt.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
275620948/HoHo/Graphics/DirectDraw.vbs
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
275620948/HoHo/Graphics/DirectDraw.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
275620948/HoHo/Graphics/Display.js
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
275620948/HoHo/Graphics/Display.js
Resource
win10v2004-20240802-en
General
-
Target
275620948/Example/Example-Graphics/Run/Example_Release.exe
-
Size
496KB
-
MD5
c16260faf43ecde0b1ed338cf81bd010
-
SHA1
30296f60e7c379d279942edf8e7fa2982a30a08a
-
SHA256
1dbcf90d71abac87e49ec1ab559fe0fc75fb217ccb9e7d4e1fe69b335652b24e
-
SHA512
c7987aee356a4581e7f50026b37702589e8323903e169bc1967cf0de6eaa3e61ae03a1719af3dc6ed44d75ed96d1b6035f560b30eabbb4ddacbd29905602ef70
-
SSDEEP
12288:QFzH+RK5zjHzgxPaLriKL7jE/RX/uF1kg:Qle05zjHzgxPyM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Example_Release.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2244 Example_Release.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\275620948\Example\Example-Graphics\Run\Example_Release.exe"C:\Users\Admin\AppData\Local\Temp\275620948\Example\Example-Graphics\Run\Example_Release.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2244