b36892cefda8addb837c36c98d69762cddbc9d87b915ef3e52fb461333e35d23

Analysis

max time kernel
141s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2836.exe
Size

2.4MB
MD5

7fed4d357026051cf6bd0b0ca549fcd7
SHA1

53045bbd80fec48e716d6aac0ea3269800914433
SHA256

0f539390c58ef24f7e32be52c85b6466f78e49eea7c0b1732d62fa9b27c5100a
SHA512

3b8d098bff5e6fc7232a00536048c35ccab0f4ba85c606bb795daeb1dae948adb680c1194b24d5c1c4ca604181babf9d5678f7a53b17088fba5872868d4d8f46
SSDEEP

24576:belo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfIxquGjHneFUJfKAOCuL+hYr2:Cl+h+1qs0Y/BTmvuGjHnevALFYy

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2836.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	2836.exe

C:\Users\Admin\AppData\Local\Temp\2836.exe
"C:\Users\Admin\AppData\Local\Temp\2836.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2516-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2516-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2516-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download