Analysis
- max time kernel
103s - max time network
18s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
21/09/2024, 01:47
General
- Target $TEMP/4204_adknowledgept.exe
- Size 1.1MB
- Sample240921-b7mgjszblc
- SHA256 e222a717b3c76ec83f55f88d1113f4abc6be660e809db00889d2aff404798eef
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\4204_adknowledgept.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\4204_adknowledgept.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
eula.html
eula.ini
eula.ini
InstallOptions.dll
System.dll
installhelper.dll
memory/3064-121-0x00000000003A0000-0x00000000003A1000-memory.dmp
memory/3064-147-0x00000000003A0000-0x00000000003A1000-memory.dmp