3126f43ce1b9721df4455b1f64fb1d23f83cb561b5b881bc95db9ed4082c109c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3126f43ce1b9721df4455b1f64fb1d23f83cb561b5b881bc95db9ed4082c109cN.exe
Size

16KB
MD5

ea05dc228f3c37fe2058198ac6742350
SHA1

342bb9e60dbc6c141782a712f8f76afd53bd6506
SHA256

3126f43ce1b9721df4455b1f64fb1d23f83cb561b5b881bc95db9ed4082c109c
SHA512

3c1e8ae4597751a36c5f169ba5bd9eb5ac34db0141e0b6f2512a91bcfe2e7cdb2dbcb7e4f9396d8511836977850f504ea9939ab827b1e6f63c355bdd6bf02708
SSDEEP

384:At4Lcg/KbxFy8iiH7RSED5o7wGZipCtp:At1/bm8NbHDKg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3126f43ce1b9721df4455b1f64fb1d23f83cb561b5b881bc95db9ed4082c109cN.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2544	3126f43ce1b9721df4455b1f64fb1d23f83cb561b5b881bc95db9ed4082c109cN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	3126f43ce1b9721df4455b1f64fb1d23f83cb561b5b881bc95db9ed4082c109cN.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1196	2544	3126f43ce1b9721df4455b1f64fb1d23f83cb561b5b881bc95db9ed4082c109cN.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\3126f43ce1b9721df4455b1f64fb1d23f83cb561b5b881bc95db9ed4082c109cN.exe
  "C:\Users\Admin\AppData\Local\Temp\3126f43ce1b9721df4455b1f64fb1d23f83cb561b5b881bc95db9ed4082c109cN.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\showthread[1].htm

Filesize
9KB

MD5
1e9c357c9dc5a823c31225dc5569084f

SHA1
b518dcd8ea8178dc66809f845bf806ded9babd0b

SHA256
5aeb6a7793fb1d407b92fd2cabe7de0f229dc8f17fed7fb1ad3f65d9222995bc

SHA512
cbef1a5b773fab6c179450611904e9a84e09c44f8b50ec3ea728a86df8f1f9615a3789ac22ec851314ecfb7afdb217d37563a26cbd68c5cdb052dde4160d8a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#5.tmp

Filesize
9KB

MD5
57b8c8b96653e5bf4128af3e35416c4a

SHA1
ada5b6ddb8b4aaae1a9191c8942faa0cd1d8bdda

SHA256
3d8ae5a31023e17c97907a3c0c9abd02bb87f1078b9cc9ffc38560da660ce1a6

SHA512
bb449778358267d12b731d169478a13c54a2a9b69df5ff1ff3236f317a10666bf99254d720b308507ba96bc68b699b4c9ab0c75c22e4eb54f21f9cef52bf0088

Download Submit
memory/1196-1-0x0000000002CD0000-0x0000000002CD2000-memory.dmp

Filesize
8KB

Download
memory/2544-0-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2544-18-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download