c61f7bbd635b35b631c45ef5aa2057c111d5ea94cd751c2f875e9a63d8ddb0ad

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c61f7bbd635b35b631c45ef5aa2057c111d5ea94cd751c2f875e9a63d8ddb0ad.exe
Size

2.2MB
MD5

62204c3b4e51ee4596bf30bcf7df8b64
SHA1

acac3bcad7a250a191819006dc4f1cf43e79f66a
SHA256

c61f7bbd635b35b631c45ef5aa2057c111d5ea94cd751c2f875e9a63d8ddb0ad
SHA512

20a159215ca63c2973c5b168f0f47518dac8c412dae4e2484b12c6c3103c46870463e14a19954bb2f34e513429814d6fee73052ee7bdd154d2675d8ce8ad6b2b
SSDEEP

24576:5Fo4xKgQHJDiLQDexn5KV8PEhDHUJgHLGsK4E8RBPmFKM7ad8IQ4jEmPEm+lFcOk:5XNv8bDHRGsK4E8ru4048tm+PTCd42

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c61f7bbd635b35b631c45ef5aa2057c111d5ea94cd751c2f875e9a63d8ddb0ad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2232	c61f7bbd635b35b631c45ef5aa2057c111d5ea94cd751c2f875e9a63d8ddb0ad.exe
2232	c61f7bbd635b35b631c45ef5aa2057c111d5ea94cd751c2f875e9a63d8ddb0ad.exe

C:\Users\Admin\AppData\Local\Temp\c61f7bbd635b35b631c45ef5aa2057c111d5ea94cd751c2f875e9a63d8ddb0ad.exe
"C:\Users\Admin\AppData\Local\Temp\c61f7bbd635b35b631c45ef5aa2057c111d5ea94cd751c2f875e9a63d8ddb0ad.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hydee.ini

Filesize
214B

MD5
fd4595c8fe8885b10c19152c21fdafc4

SHA1
56da1ba76506b3ad5e4f00a8272e53822c22c83e

SHA256
4435b1cd0d36e211e61d83c4c4ffcf91889a3eedcbf436fa172ad862c3979d06

SHA512
6328d8bca5645390c450dbd486031686eab8c2482f066f91c4893fe7f85d977dc71950210dc5bdfccfff815ff4a800f46cc472bcf60873c1791da912bb25767f

Download Submit