7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 08:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe
Size

375KB
MD5

baa812b463101ffabf186b47009e74f0
SHA1

e243a1cecc517e2fd61d44349a119b4b08299c4d
SHA256

7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0
SHA512

f26dfe9038d543c0676c6747dadacdbc34ef92c07f2bd01e187aa310e14eeedc7638135d585d3c248b2d614c1e74fe82ee3df16d819425e9f59b1764d2cbc49c
SSDEEP

6144:KplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:KplrVbDdQaqdS/ofraFErH8uB2Wm0SXj

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1840	Spanish.exe

Loads dropped DLL 2 IoCs

pid	Process
1628	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe
1628	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Russian\Spanish.exe	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spanish.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1628	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe
1628	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe
1628	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe
1628	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe
1840	Spanish.exe
1840	Spanish.exe
1840	Spanish.exe
1840	Spanish.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1840	1628	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe	30
PID 1628 wrote to memory of 1840	1628	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe	30
PID 1628 wrote to memory of 1840	1628	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe	30
PID 1628 wrote to memory of 1840	1628	7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe	30

C:\Users\Admin\AppData\Local\Temp\7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe
"C:\Users\Admin\AppData\Local\Temp\7629661a01aa419a62e1380a2b95ab870aa8423dcd97154d27f0bb3efa1c88b0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files\Russian\Spanish.exe
  "C:\Program Files\Russian\Spanish.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Russian\Spanish.exe

Filesize
375KB

MD5
be8c3a3dc4171dbce534b8a19d522534

SHA1
675c65dafd1bba1c85cbcf6269f22b2712085431

SHA256
c65b4eea21b693c5def6a61c361a1c8830d43a3a043b3a3cdb77023bcbd65b1a

SHA512
59bad8bd650b239f8297c09e83c7b2d310fe2d9bb2b7fcbff04d2e574efba04c8179088a1bc93c734500fd2c5b862fce546899c16a21f2a02c9bdb047b360609

Download Submit