ad80cade6d79d5878fd9ca377c665792bdc1611ccfabeb294ef06bee633fa5a2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/09/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation 76389812.exe
Size 796KB
Sample240924-e4ty1atbln
SHA256 ad80cade6d79d5878fd9ca377c665792bdc1611ccfabeb294ef06bee633fa5a2
MD5 44b90ea2cbfa8fe621ebb95b398469fa
SHA1 97e0a8b137aa69db09f8aae212012cb4860d0c9d
SHA512 dbcb00d99a79ad876a11c9585a08f2e880675e4b5fba32269349a989631d0f99ca0ebf742a3a452897e440f8aef41b4b8e439d6f6a16bad1611d458f4ad96e92
SSDEEP 24576:2D6b/2GVd9MSs4oOBX7Pt+SLcaaEuCNZvp7Uvf:1jVd+EogLtjaElXvGv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Quotation 76389812.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2792	Quotation 76389812.exe
2792	Quotation 76389812.exe
2792	Quotation 76389812.exe
2792	Quotation 76389812.exe
2792	Quotation 76389812.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	Quotation 76389812.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1896	2792	Quotation 76389812.exe	28
PID 2792 wrote to memory of 1896	2792	Quotation 76389812.exe	28
PID 2792 wrote to memory of 1896	2792	Quotation 76389812.exe	28
PID 2792 wrote to memory of 1896	2792	Quotation 76389812.exe	28
PID 2792 wrote to memory of 1852	2792	Quotation 76389812.exe	29
PID 2792 wrote to memory of 1852	2792	Quotation 76389812.exe	29
PID 2792 wrote to memory of 1852	2792	Quotation 76389812.exe	29
PID 2792 wrote to memory of 1852	2792	Quotation 76389812.exe	29
PID 2792 wrote to memory of 1884	2792	Quotation 76389812.exe	30
PID 2792 wrote to memory of 1884	2792	Quotation 76389812.exe	30
PID 2792 wrote to memory of 1884	2792	Quotation 76389812.exe	30
PID 2792 wrote to memory of 1884	2792	Quotation 76389812.exe	30
PID 2792 wrote to memory of 1812	2792	Quotation 76389812.exe	31
PID 2792 wrote to memory of 1812	2792	Quotation 76389812.exe	31
PID 2792 wrote to memory of 1812	2792	Quotation 76389812.exe	31
PID 2792 wrote to memory of 1812	2792	Quotation 76389812.exe	31
PID 2792 wrote to memory of 1628	2792	Quotation 76389812.exe	32
PID 2792 wrote to memory of 1628	2792	Quotation 76389812.exe	32
PID 2792 wrote to memory of 1628	2792	Quotation 76389812.exe	32
PID 2792 wrote to memory of 1628	2792	Quotation 76389812.exe	32

C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe"
  2⤵
  PID:1896
- C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe"
  2⤵
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe"
  2⤵
  PID:1884
- C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe"
  2⤵
  PID:1812
- C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation 76389812.exe"
  2⤵
  PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-0-0x00000000747DE000-0x00000000747DF000-memory.dmp

Download

memory/2792-1-0x0000000000380000-0x000000000044C000-memory.dmp

Download

memory/2792-2-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Download

memory/2792-3-0x00000000007B0000-0x00000000007C2000-memory.dmp

Download

memory/2792-4-0x00000000747DE000-0x00000000747DF000-memory.dmp

Download

memory/2792-5-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Download

memory/2792-6-0x00000000056D0000-0x000000000575E000-memory.dmp

Download

memory/2792-7-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Download