1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1

Analysis

max time kernel
84s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1N.exe
Size

115KB
MD5

0bc84f1b7fb5a1b7c37be7564a5ba270
SHA1

248bbc0c28bdaab7389628f32c9284e0161eda7a
SHA256

1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1
SHA512

f50ead766976a9b3aaa560b557c657126cfaa1a3acd085c265001e06b0a9ec292774b18b1a27c7a8b8da3d0711856c4917742895ea30c63cf40666d4cfc38063
SSDEEP

1536:GBbBABaLcVmlFW3By/WQwbdkPM0SeuploKo+kUJI55FhyqqwNKZR3cxM:YdABRmlk3vkeloKisI57sqKZR3cW

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2816	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2952	1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2816	2952	1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1N.exe	29
PID 2952 wrote to memory of 2816	2952	1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1N.exe	29
PID 2952 wrote to memory of 2816	2952	1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1N.exe	29
PID 2952 wrote to memory of 2816	2952	1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1N.exe	29

C:\Users\Admin\AppData\Local\Temp\1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1N.exe
"C:\Users\Admin\AppData\Local\Temp\1766b9a27d1046cdb334fe73545d69f8bccabc09d4e179071167b0742d5de3d1N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wsf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wsf..bat

Filesize
276B

MD5
5b63f72bb170b47cd2ee9a0a019fddd6

SHA1
48b4a0e4f2fdd551d464f212ca798e10bd4ccac1

SHA256
9913c8b81db38246e23c4c12ae145fa57076b3f85b8466a1802f96f7d2122686

SHA512
2dcf8fd45139ed66c9c4ce1316efa00dca5cdb34013951c3304bb3f995187521ccff6779ff44797585b267627e6e7c698dc777f04ae52de784ae059ca0a62063

Download Submit
memory/2952-1-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/2952-0-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/2952-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2952-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2952-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2952-6-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download