Analysis
-
max time kernel
94s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 06:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe
-
Size
176KB
-
MD5
cd5e20782a1d5c1671f8dade62a65890
-
SHA1
4835aab07407c68bbdac80971eef6fbba2ee2173
-
SHA256
16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3
-
SHA512
6b35393bd74b1557df813b75f9a3fd7348af69bb7004feebdc890d6ddcef9b0b45954ff2a3ce6113b58e62cd473cacf2ce18dd93b3233492f7111d01b905b6b9
-
SSDEEP
3072:6Z8/d5fGx46QUjf29pJxrbJb0r81dNNmlsSKB:62/d5tRVQr8PNnX
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\TypeLib 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\ = "clsSettings" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D} 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}\2.0\FLAGS\ = "0" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E} 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cizrb001.clsSettings\Clsid 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E}\Implemented Categories 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6344F3B4-FB92-4AF2-96B1-CCE49C15875B}\Programmable 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6344F3B4-FB92-4AF2-96B1-CCE49C15875B}\Implemented Categories 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\TypeLib\Version = "2.0" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\TypeLib\ = "{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\TypeLib\ = "{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E}\ProgID\ = "cizrb001.clsSettings" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E}\Programmable 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6344F3B4-FB92-4AF2-96B1-CCE49C15875B}\ = "cizrb001.clsNonStkItemRpt" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6344F3B4-FB92-4AF2-96B1-CCE49C15875B}\ProgID\ = "cizrb001.clsNonStkItemRpt" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6344F3B4-FB92-4AF2-96B1-CCE49C15875B}\TypeLib\ = "{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\TypeLib 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6} 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\TypeLib\ = "{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cizrb001.clsNonStkItemRpt 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}\2.0\ = "Non-Stock Item Report" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\TypeLib\ = "{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E}\VERSION\ = "2.0" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cizrb001.clsSettings 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6344F3B4-FB92-4AF2-96B1-CCE49C15875B}\ProgID 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6344F3B4-FB92-4AF2-96B1-CCE49C15875B}\VERSION 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6344F3B4-FB92-4AF2-96B1-CCE49C15875B}\TypeLib 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}\2.0\FLAGS 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\ = "_clsSettings" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\TypeLib\Version = "2.0" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\TypeLib 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E}\TypeLib\ = "{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\ProxyStubClsid 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\ = "_clsNonStkItemRpt" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\TypeLib 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E}\LocalServer32 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cizrb001.clsSettings\ = "cizrb001.clsSettings" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cizrb001.clsNonStkItemRpt\Clsid\ = "{6344F3B4-FB92-4AF2-96B1-CCE49C15875B}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\ = "clsNonStkItemRpt" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}\2.0\0\win32 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\ProxyStubClsid32 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\ProxyStubClsid32 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\ = "_clsNonStkItemRpt" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E}\TypeLib 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cizrb001.clsSettings\Clsid\ = "{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D} 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\ProxyStubClsid32 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDF8FEC3-B7CE-4D41-AF69-3315D04F162D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\ = "_clsSettings" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6344F3B4-FB92-4AF2-96B1-CCE49C15875B} 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}\2.0 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6344F3B4-FB92-4AF2-96B1-CCE49C15875B}\VERSION\ = "2.0" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB8FA0A5-03DC-4CB7-8707-A0452BF4311D}\2.0\HELPDIR 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6} 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D293BE1-2E73-4EB4-8C31-9708C33D29C6}\TypeLib\Version = "2.0" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E4E9D54-34A8-4ED0-BA68-B45B61AF6E9E}\ = "cizrb001.clsSettings" 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2144 16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe"C:\Users\Admin\AppData\Local\Temp\16dcefdac48687b32e4ccbf2af7e5144fdfdb68df356aac3ae0b43550eb265c3N.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2144