6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972

Analysis

max time kernel
127s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972.exe
Size

38KB
MD5

3cc48836669d7affdad8a27c59942477
SHA1

6619aadb0ec85de6d28fb787a7a8c3b6052480f8
SHA256

6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972
SHA512

cae53b4fdb88a6779a398d9c7922a591c9eaed383139c4d6b621769fc53c728bb47284f2faac29f80c59f01bcf3f05db85e7f54a5483b1160b652360f8480fca
SSDEEP

768:y8eRH+9lFh0ul16sh7iQroCHrf+RjFBSuB2Xs:y9l+Z16sh7iQroCqRB0uJ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2176	bkgrnd.exe

Loads dropped DLL 1 IoCs

pid	Process
2924	6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bkgrnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2176	2924	6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972.exe	30
PID 2924 wrote to memory of 2176	2924	6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972.exe	30
PID 2924 wrote to memory of 2176	2924	6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972.exe	30
PID 2924 wrote to memory of 2176	2924	6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972.exe	30

C:\Users\Admin\AppData\Local\Temp\6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972.exe
"C:\Users\Admin\AppData\Local\Temp\6af668a1115f06415a3fea013f2462f6ca160610cd31c06d759c9f960ea54972.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe
  "C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe

Filesize
38KB

MD5
df635bffc8545b7be77b588775e7a826

SHA1
c64158fba250f1207698a8b2c31c61dff02b1d9e

SHA256
dc6109cc17fe9df6b7c9e0080b821f1a93dd86c5920cc958a7c5227902017a5c

SHA512
aca83e74b0476d82c136d0e355e56693ded1163fbe7da5df11b5338a4fb321f697aeb32b6101360dbd425fd1b3cf941fd9f836b911a4e4793784aefe32c2998c

Download Submit
memory/2176-36-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2924-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2924-2-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/2924-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/2924-7-0x00000000006B0000-0x00000000006BA000-memory.dmp

Filesize
40KB

Download
memory/2924-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download