bd9ea8b56ffc2ab9f8903d23d27007365b411ae06d207ec27252e894ecab7106

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

-lightroom 5 עkeygen/keygen.exe
Size

121KB
MD5

67766ceb8f827dd4e99af10d416ff893
SHA1

982ed4893d3e6d2dab652fac8a0dc0f4d52a06b7
SHA256

c666b29230f5c2c29a79830177e0dda67c13cd8cbea227d3c4beeb800a98fea5
SHA512

be5086467098605d008784b79e7937d622532be558d03cd744755137b223fa72aeeefc84612568ad4da4188c749584cee26bc6cb35eb9cf995133735af4235f1
SSDEEP

3072:A3p+0+TBU5RtJ4jhvawCf5h9zYRGDZ11wBnrlnhUmP:A3SmbtJevawCxh9zYUN11srZia

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	keygen.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	keygen.exe

C:\Users\Admin\AppData\Local\Temp\-lightroom 5 עkeygen\keygen.exe
"C:\Users\Admin\AppData\Local\Temp\-lightroom 5 עkeygen\keygen.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\drivers\etc\hosts

Filesize
1007B

MD5
c7ae5f79bc317b11144cb82abefa8dbc

SHA1
0f95f569c33492930089ae3dd68320c42d5b2640

SHA256
f361dc700304304bb795986dc1216080551b4c0773c710548108f96d85d6132f

SHA512
ea518082911e68fc8a4c2e09a14f14776f1dae3fb61ddb45981df6d99f74ed8c88a288b3b22f302a60a347e8ef405b06a75a738df8c0893e064dcd13832359dd

Download Submit
memory/2720-20-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-12-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-2-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-6-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-7-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-9-0x0000000000401000-0x00000000004B1000-memory.dmp

Filesize
704KB

Download
memory/2720-10-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-25-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-1-0x0000000000401000-0x00000000004B1000-memory.dmp

Filesize
704KB

Download
memory/2720-0-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-5-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-17-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-11-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-28-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-33-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-38-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-41-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-46-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-51-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-54-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-59-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-62-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/2720-67-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download