aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5

Analysis

max time kernel
31s
max time network
32s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5N.exe
Size

54KB
MD5

5d19faef8d33d5ed186e200f365c4b00
SHA1

e998e4791ade3df108e084e78b30ff306b878057
SHA256

aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5
SHA512

f45f05effb2f744d38af66afdd30512cfdde23ca641f191a44d5c96f6eaff332125498c339845b7b60d3f2f1b30fdfea0025da7389756b8a61f2cacca7aa25dd
SSDEEP

768:oOY2HJSxb3HXBQFKV9V/vbwaoiwDtVUTuSJxg:oeoxMKvV/kaefpMC

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2160	hfdfjdk.exe

Loads dropped DLL 1 IoCs

pid	Process
2088	aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdfjdk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2160	2088	aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5N.exe	30
PID 2088 wrote to memory of 2160	2088	aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5N.exe	30
PID 2088 wrote to memory of 2160	2088	aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5N.exe	30
PID 2088 wrote to memory of 2160	2088	aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5N.exe	30

C:\Users\Admin\AppData\Local\Temp\aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5N.exe
"C:\Users\Admin\AppData\Local\Temp\aac8f0307ec33c90240154e903f80758e2b8ed2942bfc153f604a808e97fdca5N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\hfdfjdk.exe
  "C:\Users\Admin\AppData\Local\Temp\hfdfjdk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hfdfjdk.exe

Filesize
54KB

MD5
140686e1aecd2e54b98c58de7e25c91e

SHA1
bd1e6ea1f858aa70c2a256dd7bddd3432452949e

SHA256
94d7e9cbf94748ead85b73c4a14ed29245b4e2cd380f371f6e438b1dec0016b1

SHA512
d4cb1859674106a2466d5137dfe52e305a4a1897b5fb534ef5e55d787b57b8063a0685100f59b9ae8fa023dcf3212961da1dd7f8f056da1cb5d2c90d5387e057

Download Submit
memory/2088-1-0x0000000000130000-0x0000000000134000-memory.dmp

Filesize
16KB

Download
memory/2160-8-0x0000000000160000-0x0000000000164000-memory.dmp

Filesize
16KB

Download