6858af2688d2e14af2f506e8a268045e38a9ee1a69759ded34c506c112910958

Analysis

max time kernel
147s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
11/10/2024, 18:06

Target
Service[1].exe
Size 382KB
Sample241011-wpy3va1amn
SHA256 6858af2688d2e14af2f506e8a268045e38a9ee1a69759ded34c506c112910958
MD5 021db70d51c7eb264d8e3d201987de59
SHA1 a149857a61bf22d84960f4fbc3fe39cf6b1661da
SHA512 4feb593d7200a6da7b33e98ef31c414c33b52ec04b04a20b1eb1d5f388aff702dea0cde493156d9e9ff57abba3872c376ed84bd3a0e0b76a26e14efd55e58f7e
SSDEEP 6144:W35lLu/HzRf/kUDUltCdq4Zqc0W50fC0pw0pN0Obw2z8qhqscwE4jxoMv0fXhMwD:Wp6RfIl0Y4OMIY4j1YXhMwLnn
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Service[1].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4048	schtasks.exe
2240	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 4048	1688	Service[1].exe	77
PID 1688 wrote to memory of 4048	1688	Service[1].exe	77
PID 1688 wrote to memory of 4048	1688	Service[1].exe	77
PID 1688 wrote to memory of 2240	1688	Service[1].exe	79
PID 1688 wrote to memory of 2240	1688	Service[1].exe	79
PID 1688 wrote to memory of 2240	1688	Service[1].exe	79