Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2024 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
General
-
Target
62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe
-
Size
26KB
-
MD5
619966f330f1d3c20fa94913272b855f
-
SHA1
dee029545d753242807407af6f781a931d13bc7e
-
SHA256
62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88
-
SHA512
c3556183df94d15b433f1edc077c3d94bc2e88a4c09ab30d38d188ba776d1dc0d65677a39fe99901b01ac2722085de9ab60302faa1296e95c4e1dd0bd8abdba7
-
SSDEEP
384:ULd6YmXDZ/XgPMRefHzCYe/OhY2OzRLTm3yilqr636b4tVvGz:ChMDZ/+MMT5e/MsEXVvGz
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: SeIncBasePriorityPrivilege 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe Token: 33 384 62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe"C:\Users\Admin\AppData\Local\Temp\62d2fb937986d4de515de03d56edc5a8f1dc8009b60ff8e39f7535a224aacc88.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:384