Analysis
-
max time kernel
94s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 03:51
General
-
Target
e173b17e3b1edd333c0e39e5a8176005cd258a16f9a3431285b55adf94f664b3.exe
-
Size
8.0MB
-
MD5
75a87661276be4c9bdb2f26da02ad522
-
SHA1
788251f50986364fb0ad1eb9d0ec75aace30144b
-
SHA256
e173b17e3b1edd333c0e39e5a8176005cd258a16f9a3431285b55adf94f664b3
-
SHA512
7d5d87fc4489cae56db86feb98a61dcbce6b4e18722fc9107d303a0ea8ac03ee261bdea91d5776c091e2cb90e6a97bc27264203674cfa07810373dc07f227ec2
-
SSDEEP
196608:KnLxgofFJmWcMEabkL0a3uTF9H8IM0l3qeXG+1zbFLOyomFHKnP:ujfOabkLz49cSlZXDzbF
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e173b17e3b1edd333c0e39e5a8176005cd258a16f9a3431285b55adf94f664b3.exe"C:\Users\Admin\AppData\Local\Temp\e173b17e3b1edd333c0e39e5a8176005cd258a16f9a3431285b55adf94f664b3.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx