Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 04:40
Behavioral task
behavioral1
Sample
WPE/WWQQQQ.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
WPE/WWQQQQ.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
WPE/wpe.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
WPE/wpe.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
wpe/Usp10.dll
Resource
win7-20241010-en
General
-
Target
WPE/wpe.exe
-
Size
280KB
-
MD5
d0e857c7930abd5a3e11d63d2e2a8df5
-
SHA1
3088d54520a3eba166a74623b674ff7d8f896627
-
SHA256
e6231705c371d51a5cb5260d2f7caf3fb3ccaa52340ab4d7efa593e0de362e66
-
SHA512
790fc5cf27139c2d2a752e6c98c00f7b93389814b202cc60002da6ff419d4146749160ad87860e8d6163b46d560d8970d322cd86dfa140694a9a8ca3e2a4501e
-
SSDEEP
6144:rFAJmiX6NTxg1p8skuNs+NNnoAFecndJgiqzuksV03KabW/tLSxCQ:ZAJ0NTCH8skcXnoA3UTzu7Da2EIQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpe.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2532 wpe.exe 2532 wpe.exe 2532 wpe.exe 2532 wpe.exe