Analysis
-
max time kernel
1197s -
max time network
1190s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04-10-2024 20:20
General
-
Target
Payload.exe
-
Size
55KB
-
MD5
4f0249929ce845b18b7f909ed29ff4e4
-
SHA1
a6f0627d3b5d45b2481bdf7be97865ec06774c94
-
SHA256
016a72d36bc45f96e4149849cdd1b60d573736f8268033b23bf7fe7a33cf0d9b
-
SHA512
a5aef8e4e192f6f8caad15c1493e8d38a017f05c6a9f466e1840fe657bee760b69a5c52881e9e6e950fd9e71ea527de302b879870616794f7b8e4f72d80e1bd3
-
SSDEEP
1536:0GLu8DnN8N1+S1Cl/BODuwsNMDmXExI3pmNm:S8DnNGcXODuwsNMDmXExI3pm
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 168 Payload.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe Token: SeIncBasePriorityPrivilege 168 Payload.exe Token: 33 168 Payload.exe