Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2024 10:49
Behavioral task
behavioral1
Sample
aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe
-
Size
914KB
-
MD5
d314447bfe78be921cb5db03d138d5d2
-
SHA1
87ef7e53ba2b644a8638c9efd16ecaf445d393cc
-
SHA256
aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267
-
SHA512
7207fc3560a459f6678e60af78de888fad5ae1dda7ebe37ffb1e4f3a921760ae67fe2a33279f5451820af6d51ba4c975d385abdbc879fbae833128a24b5ef151
-
SSDEEP
24576:wc5ndIGN7QDVHriGNdKY9AO+sCaqht2keZ1yugLYlr:t5nnQDVOTeAJr2keZsrYR
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3196-0-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/3196-3-0x0000000000400000-0x0000000000608000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe Token: SeDebugPrivilege 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe 3196 aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe"C:\Users\Admin\AppData\Local\Temp\aa4a45d59215d88f5bbb79f4020cbb24cb9809b8d0c651eed9c4c9a44fe15267.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3196