688f00cce09a08dd578c0f572fe7ff0987ee4235cf9c3d15af5364f9417abdde

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 19:40

Target

688f00cce09a08dd578c0f572fe7ff0987ee4235cf9c3d15af5364f9417abddeN.exe
Size

31KB
MD5

f3f13a88f5cfae5fc65a92c885e57e80
SHA1

bfb0f77c080e57a4b3d0e45e4debc479b7f850c2
SHA256

688f00cce09a08dd578c0f572fe7ff0987ee4235cf9c3d15af5364f9417abdde
SHA512

8bde1bcffc399d7b4eab692a4871ef600eeb379a4c24b5112bfe97ec29b50a3319941c381cc0c5e12732643b1092f4ab6e93792db559de67a4bd656eb57619c5
SSDEEP

768:zIPfXOhlKoLxtCt74y/842kGim5admgS0CX0ME:4CKoLD+h/84UimkdxME

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	688f00cce09a08dd578c0f572fe7ff0987ee4235cf9c3d15af5364f9417abddeN.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2364	688f00cce09a08dd578c0f572fe7ff0987ee4235cf9c3d15af5364f9417abddeN.exe
2364	688f00cce09a08dd578c0f572fe7ff0987ee4235cf9c3d15af5364f9417abddeN.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1224	2364	688f00cce09a08dd578c0f572fe7ff0987ee4235cf9c3d15af5364f9417abddeN.exe	21
PID 2364 wrote to memory of 1224	2364	688f00cce09a08dd578c0f572fe7ff0987ee4235cf9c3d15af5364f9417abddeN.exe	21
PID 2364 wrote to memory of 1224	2364	688f00cce09a08dd578c0f572fe7ff0987ee4235cf9c3d15af5364f9417abddeN.exe	21
PID 2364 wrote to memory of 1224	2364	688f00cce09a08dd578c0f572fe7ff0987ee4235cf9c3d15af5364f9417abddeN.exe	21

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1224-2-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1224-5-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2364-0-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2364-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2364-14-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2364-15-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download