23c707f9cc1a222d593738b5fcaf9d06da19104b83be91788c879f134800a851

Analysis

max time kernel
100s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23c707f9cc1a222d593738b5fcaf9d06da19104b83be91788c879f134800a851N.exe
Size

732KB
MD5

eef803f8f59092866375b3807108e4f0
SHA1

9f8b3145b8088c43db180b9d8c62ad2cf46a4055
SHA256

23c707f9cc1a222d593738b5fcaf9d06da19104b83be91788c879f134800a851
SHA512

e19a4272662e09a81eac403df1ce58dbe2105b703b50884f18dcacf7d29e1e6c85bc273f4713ee9bd29c03ac32a3f339d2e2f1b37ff433d632c4435c3310901f
SSDEEP

12288:UDCxGuO8ODZ+1JbpyMpq65OxDub4hkWGzCeVIOqjcqjdOYmSaarVaEoVN4r:UUMZe1pyM1OxDG4hkkOq4SOYmS5Z+Vqr

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2296	23c707f9cc1a222d593738b5fcaf9d06da19104b83be91788c879f134800a851N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23c707f9cc1a222d593738b5fcaf9d06da19104b83be91788c879f134800a851N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2296	23c707f9cc1a222d593738b5fcaf9d06da19104b83be91788c879f134800a851N.exe

C:\Users\Admin\AppData\Local\Temp\23c707f9cc1a222d593738b5fcaf9d06da19104b83be91788c879f134800a851N.exe
"C:\Users\Admin\AppData\Local\Temp\23c707f9cc1a222d593738b5fcaf9d06da19104b83be91788c879f134800a851N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst8355.tmp\ioSpecial.ini

Filesize
730B

MD5
7491193d2b073a25ee6cd51c8b7cdd74

SHA1
e18055ed522b811e42f3ebcf7cde5ef12bdc2119

SHA256
58ea3204a99663af0a11a2683f36d3e054548fcd35b80101e9c495ddd122cb89

SHA512
a6082791b8c7b0c4e46877c0c0a6e839efb46d927cc69694b67c3ff52c151291f762f2b1d2d71623ea418e6d65bbd043dc238a72fb5fbfe71a6a200ef64f6b00

Download Submit
\Users\Admin\AppData\Local\Temp\nst8355.tmp\InstallOptions.dll

Filesize
12KB

MD5
f407939127208a009b9a825cb77ed3c7

SHA1
051d7fccf3fb544acaa8ab6be590bb4bc79cef82

SHA256
191fab998e58b66a2416873b06062166b547eb3ba06b1326a4a785a566aaf76d

SHA512
d45d08823ac7667f071b21d238b7fda43115db3195a442cb17d880d147e8a930374403c970afc31f676f01a83fb9c63e3be047de7e16718a08a1fdbe4b690901

Download Submit