Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30-09-2024 13:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
file.exe
-
Size
823KB
-
MD5
e7077a89901f62b2ef9559d7631d02c0
-
SHA1
204fb5dc840946279b429199e075164ed59aecae
-
SHA256
6e99f41ac17bbbcfbb0bcd6ea1f2b3a9c7b659981ff6da15ff24d44385d58f3b
-
SHA512
65040856fe0092bdca034ce29db335166bea0c3c0fabd5bfd50a6c2c1358c61a69d57f3e8c347da1a831c6c2d1a4be7755edf6a085aa5a413b86e540bf64515b
-
SSDEEP
12288:DCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgaxnIQ:DCdxte/80jYLT3U1jfsWaxnIQ
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe 2700 file.exe