Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-09-2024 06:47
General
-
Target
Usermode.exe
-
Size
464KB
-
MD5
cc73f4651997512586650b663428d00d
-
SHA1
b44062a9b1b12a379367676dbc63bf6bf8e305a7
-
SHA256
e9532f3dfcdd430a2c2dd5c993bccd0f13056bde3a1da73cb97da99a27207e3c
-
SHA512
41ba974976b0d9cbd1b979db400ad9246bb73b695f8626ae811de69e7e275d12b2b95635c511544fe9a683ed82e374612540c345fe1502e31a99191360d7ea9f
-
SSDEEP
6144:9N/HnAgUhumm5RcEmXDvXiYCewjJrSjgKAQ5f0XXZL45S0O9CQcT8Cah3CY5ER5N:jnATzm5eXjX/ajCgI5suu9CQcICHYYv
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Usermode.exe"C:\Users\Admin\AppData\Local\Temp\Usermode.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx