48254bfde00c8a7e45c71e063ee689ef3c59fb765e44abbad5d75011940593c8

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tracker.exe
Size

762KB
MD5

ace46e05df8bdbeb0a7c6aee4cc492b4
SHA1

758fecab9126b0d307fec0a5f17b40a8fb49ce52
SHA256

f277d9aab1920f612c3f7cd1b5e5c06f57c8120e355e40cd1c15b6b0e9b4171f
SHA512

1f1f4887b912b3dbb9aef39041ad610845e99079f46ae90ba177da13e069affcac1fd7ad80f268bf22db7b3fd2ffb90b7bd33748b64010a161864566f9408079
SSDEEP

12288:1e0kpHfpyYKXsBHn0zDCIzH/QiGAW+Xe7aLUcns+/9:iBUzDnTYiDWc9

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral22/memory/2392-0-0x0000000000400000-0x0000000000641000-memory.dmp	upx
behavioral22/memory/2392-56-0x0000000000400000-0x0000000000641000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tracker.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\Desktop\DragFullWindows = "0"	tracker.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe
2392	tracker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2392	tracker.exe

C:\Users\Admin\AppData\Local\Temp\tracker.exe
"C:\Users\Admin\AppData\Local\Temp\tracker.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tracker.INI

Filesize
167B

MD5
3ac1e99baf322c6fa071f7a7046ecf5e

SHA1
9c5cb8a41e6cb06583c9ae81c544409a78c5560a

SHA256
3577dbc3af0bcf89963b909a73b29474e74a05042e49e55e182a3b51e485e835

SHA512
645fd503c405547813c45328b97db6d2fe0b0b9ad187c9553bb2b3486374dabc76f0a0ba19f7ccc4ab7364947f931f540591179e604689751fdaf6e7be1b6b54

Download Submit
memory/2392-0-0x0000000000400000-0x0000000000641000-memory.dmp

Filesize
2.3MB

Download
memory/2392-1-0x0000000000BE0000-0x0000000000BF4000-memory.dmp

Filesize
80KB

Download
memory/2392-3-0x0000000000C20000-0x0000000000C31000-memory.dmp

Filesize
68KB

Download
memory/2392-2-0x0000000000C00000-0x0000000000C1D000-memory.dmp

Filesize
116KB

Download
memory/2392-4-0x0000000001120000-0x000000000156A000-memory.dmp

Filesize
4.3MB

Download
memory/2392-56-0x0000000000400000-0x0000000000641000-memory.dmp

Filesize
2.3MB

Download
memory/2392-61-0x0000000001120000-0x000000000156A000-memory.dmp

Filesize
4.3MB

Download
memory/2392-60-0x0000000000C20000-0x0000000000C31000-memory.dmp

Filesize
68KB

Download
memory/2392-59-0x0000000000C00000-0x0000000000C1D000-memory.dmp

Filesize
116KB

Download
memory/2392-58-0x0000000000BE0000-0x0000000000BF4000-memory.dmp

Filesize
80KB

Download
memory/2392-57-0x0000000001000000-0x000000000111E000-memory.dmp

Filesize
1.1MB

Download