Analysis
- max time kernel
149s - max time network
120s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
16/09/2024, 04:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
tmp1jcb32dh.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp1jcb32dh.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target tmp1jcb32dh.exe
- Size 896KB
- Sample240916-e64k8azbjn
- SHA256 b119eb3e182224d5399b12f7f106ffd27a0f12dd418a64aa23425000adbc44de
- MD5 e05c771e10e66325db36ea2d9839bdea
- SHA1 efa6c54976c7a01033f1c1f2f27909f1c1e640de
- SHA512 4a67c20b04a3a2b663d4408c9448f08ef8c1c76292690acf99579cd6a8bc9877b2f3705533c931c0b4713d375b5632546d60405a4a37010f4a882f33a0482545
- SSDEEP 12288:PqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaITg:PqDEvCTbMWu7rQYlBQcBiT6rprG8aQg
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp1jcb32dh.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe 1076 tmp1jcb32dh.exe