Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27/09/2024, 23:48
General
-
Target
DANCING-BUSH.exe
-
Size
724KB
-
MD5
42822a949f7184b47359cdcaf23ecfaa
-
SHA1
3d93e9fd1c9e903740153bcee5261bcb41d411da
-
SHA256
e3284767ed9012b839d49c3bc60e84f72c6cce051a2620ecfec48a7b081d6820
-
SHA512
9212993fa6761c10d1fb5722e8c3fb082250b84670b1c783d1e6a342ea5922c70673c7cfb536b6a111b663b44e504e0464dd6d460f36b99e14446cef4a8047f8
-
SSDEEP
12288:g0/zSknQPmbFlXTPhvHA7azeJdijkc4IZrLxu50gRtJ0FqH6a4XN5S:AqbFR9A7aCdrRthH6N0
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DANCING-BUSH.exe"C:\Users\Admin\AppData\Local\Temp\DANCING-BUSH.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x504 0x4fc1⤵
- Suspicious use of AdjustPrivilegeToken