Analysis
-
max time kernel
130s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-09-2024 17:34
General
-
Target
svchost.exe
-
Size
1.1MB
-
MD5
b712b99d538d008e8143133ac693ef51
-
SHA1
cfc1258686f1a225d2135ed6c0732baf63ca669d
-
SHA256
070d3e2a7c22c669354fbe8fe40f411f26b247c5077049f2b8e51d702ea0f730
-
SHA512
f0a1f78761d334bf71ab19f862950541853a52191f2b5709a351094ca116929b46965c8d5c6b1b0a4a2ef0651407a37a8550d8d26254619f9f4f5352419bb72a
-
SSDEEP
24576:0RmJkcoQricOIQxiZY1iaJPxDnQTaBCoBunYWb5LtIu:RJZoQrbTFZY1iaJPxD4XwQt9
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam