cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 21:16 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
Size

1.1MB
MD5

5987d3df499f68f6eae09a7637e53343
SHA1

5aafb46bc7a33b47358ae523fb2a878160154e43
SHA256

cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9
SHA512

2b42ad5b08c42b5c4f66e14914a1c821ccb0e4310276c8fceb4a908f60474e102979e9a761c372023252c97d0c7e34557f3b473bd83c496af43047224804f61d
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QK:CcaClSFlG4ZM7QzMJ

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2892	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2892	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
2892	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2880	2892	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe	30
PID 2892 wrote to memory of 2880	2892	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe	30
PID 2892 wrote to memory of 2880	2892	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe	30
PID 2892 wrote to memory of 2880	2892	cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe	30

C:\Users\Admin\AppData\Local\Temp\cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe
"C:\Users\Admin\AppData\Local\Temp\cd2f1d372bdce78fbe79837117df06eeae6aa1f01ca424a5fa182e6c51c2ada9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
88e3336f3148f8bf8d56f9b64e80f2cf

SHA1
ab36164d15c80f5f34111984263b6f8793b6daf0

SHA256
a169ecc16f78fe6470f419c8da4a045f36611750eba6e3d7b5e97ffddc8e3201

SHA512
4372b02ba29bf2423c1c94a6b90bb3a21faf52e1bf7c3caae5f90a2bfd6d1b6bb48fa9d22c623967ff7c1826e6305a7993757391e4ff9ec41588567f8f39c243

Download Submit
memory/2892-8-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download