Analysis
- max time kernel
120s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/10/2024, 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
120 seconds
General
- Target eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701N.exe
- Size 333KB
- Sample241012-19fjfsyemk
- SHA256 eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701
- MD5 d7eadfc3b361f326c7999dbe8e9ef7f0
- SHA1 28f936a78ef9cefda0667714f8fff6a9a7c76fd0
- SHA512 52534ed43e05a3413852714591e919379f514c5f3d4af5a60d718a5c64ce4976af69c79d90c55d3b2063ffa9a5021f0fb919285ca54b7e03f18689569c032655
- SSDEEP 6144:eILU50cDi8Ar3vLkf049n/m+GGv9uLrmSVqjy00tDxta+7SY2f:e9GSOCunmqDBSn
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701N.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "59" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 548 eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701N.exe 548 eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701N.exe 548 eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701N.exe 548 eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701N.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 3800 Process not Found 1744 Process not Found 3664 Process not Found 5064 Process not Found 4908 Process not Found 4888 Process not Found 2828 Process not Found 3592 Process not Found 1644 Process not Found 1484 Process not Found 400 Process not Found 3804 Process not Found 4596 Process not Found 736 Process not Found 2528 Process not Found 2852 Process not Found 2560 Process not Found 1676 Process not Found 3752 Process not Found 4476 Process not Found 3988 Process not Found 3048 Process not Found 628 Process not Found 2764 Process not Found 2732 Process not Found 1872 Process not Found 3412 Process not Found 1812 Process not Found 3244 Process not Found 416 Process not Found 1240 Process not Found 4484 Process not Found 368 Process not Found 744 Process not Found 3160 Process not Found 4036 Process not Found 1308 Process not Found 2628 Process not Found 4236 Process not Found 2688 Process not Found 1092 Process not Found 4188 Process not Found 1684 Process not Found 3504 Process not Found 680 Process not Found 4640 Process not Found 2888 Process not Found 3260 Process not Found 4472 Process not Found 3464 Process not Found 4080 Process not Found 2820 Process not Found 3836 Process not Found 4012 Process not Found 3572 Process not Found 3984 Process not Found 3700 Process not Found 856 Process not Found 1600 Process not Found 4220 Process not Found 4116 Process not Found 4280 Process not Found 1424 Process not Found 4980 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4880 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701N.exe"C:\Users\Admin\AppData\Local\Temp\eb5b250be045ebb96ec3be53ff2a81a3d34a7c7e2e892cc378d8fa7b05a84701N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:548
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa397a855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4880