Analysis
-
max time kernel
299s -
max time network
305s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-10-2024 20:53
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
General
-
Target
Payload.exe
-
Size
55KB
-
MD5
c410a49af4db43bc049c53d3a2c922f1
-
SHA1
474b85960f5172f4ae00185e7ce176fd6f0d4b81
-
SHA256
a3567d00fcd938526639475739fcdb6d761711d0a91c8e0408a878808f21a2d9
-
SHA512
79bd9bb438018c9c1c182d55558cd56708d65061cccde0f357d93f609375a8ef9eada69b2276b39599bbf5bf24f11ff9e483f0a2ebda0f9db202a5b85ef87e0d
-
SSDEEP
1536:EBtu8DnN8N1+S1Cl/BODtwsNMDqXExI3pm0m:T8DnNGcXODtwsNMDqXExI3pm
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe Token: SeIncBasePriorityPrivilege 2208 Payload.exe Token: 33 2208 Payload.exe