a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe
Size

1.1MB
MD5

5d54dae3912c175df2322926b3057028
SHA1

3a5960fac828d750db7dd6f7f4c6836603ee7ae4
SHA256

a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703
SHA512

75a3c55d5c57e28565117318c66e5b4b7821172d3bdd681da87a2ccdf3d777abe861f33a9827768ce18df822414d662e03553bb7278a6aa6f2461ce1c9646491
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5QD:CcaClSFlG4ZM7QzME

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2140	a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2140	a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2140	a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2140	a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe
2140	a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2696	2140	a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe	30
PID 2140 wrote to memory of 2696	2140	a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe	30
PID 2140 wrote to memory of 2696	2140	a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe	30
PID 2140 wrote to memory of 2696	2140	a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe	30

C:\Users\Admin\AppData\Local\Temp\a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe
"C:\Users\Admin\AppData\Local\Temp\a36a01efe45ba2719ceb96b54cdb219b314c8beb0e1a3f269dc2f5ac2ce7a703.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
94582c2b2d7de9598b4fd059689cbda3

SHA1
55d1839f93d9e3701373d90ac2514270f36cf98a

SHA256
c12445ec6c337d4d633d9712959b0d1b6eae6db6a363b0d41e251f4c16027e2d

SHA512
3455a6c324431487aa9381d414395a5ed5cec708111432685c33e64e0264c8cdb536b642a0bcee167581393cb6f49474d7662f82ef96cb4c3f5570f8bbffd066

Download Submit
memory/2140-8-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download