Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 11:45
Static task
static1
Behavioral task
behavioral1
Sample
Shared Folders 2023-Documents/-1-Shared 2023-Documents pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Shared Folders 2023-Documents/-1-Shared 2023-Documents pdf.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Shared Folders 2023-Documents/msimg32.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Shared Folders 2023-Documents/msimg32.dll
Resource
win10v2004-20240802-en
General
-
Target
Shared Folders 2023-Documents/msimg32.dll
-
Size
4.0MB
-
MD5
48a1348a537fa2af64a9697862c88180
-
SHA1
3fb72905c9abcf52358d4bbf97f82b191c9695b8
-
SHA256
917cb2dcc4f1269340112c51dc5a6afdf2d5e422ad102d702119338cef2a9fe9
-
SHA512
6e09334c550e68224ce16c90fa26da873e9fb969237ac89fae292db56f30105e350334ab7bfe91eb79783718f5044a87491170f4c139f8b4c4e8a60338fe698f
-
SSDEEP
49152:Mtw8A/gVIBl8dZVvYC/2NEveBiDw0uU4aC+1R6yrLBV9T4Z:4wArqNxYDw0Z4ajvPrD9T4Z
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3352 wrote to memory of 2072 3352 rundll32.exe 89 PID 3352 wrote to memory of 2072 3352 rundll32.exe 89 PID 3352 wrote to memory of 2072 3352 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Shared Folders 2023-Documents\msimg32.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Shared Folders 2023-Documents\msimg32.dll",#12⤵
- System Location Discovery: System Language Discovery
PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4076,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:81⤵PID:3232