1a4a3457cb3a57ecb7cafcad9011e18a0959d2071620048a7815483fa37fe758

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a4a3457cb3a57ecb7cafcad9011e18a0959d2071620048a7815483fa37fe758.exe
Size

4.8MB
MD5

813a553efe0722b06f5516c1203f4c2a
SHA1

9203cce6e2b349093779586d046bc7717bf09ade
SHA256

1a4a3457cb3a57ecb7cafcad9011e18a0959d2071620048a7815483fa37fe758
SHA512

c4670b2e2688c6dfb6a1838c79430551e7c0f61583d1aa13ee8b8ff4e96661f9e6f59c22a7a99cd2c7710b6148eda056d8a473ac7e1e78c45dfd6ac8101f6230
SSDEEP

98304:paef88hftahxwIUY9WUEyJMQB9VMob9fvx+VjrnLi6zxA5EH+tjOH:pxf8Yf8xVWtyHVxblZUHnLfXH+M

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a4a3457cb3a57ecb7cafcad9011e18a0959d2071620048a7815483fa37fe758.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	1a4a3457cb3a57ecb7cafcad9011e18a0959d2071620048a7815483fa37fe758.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2860	1a4a3457cb3a57ecb7cafcad9011e18a0959d2071620048a7815483fa37fe758.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2860	1a4a3457cb3a57ecb7cafcad9011e18a0959d2071620048a7815483fa37fe758.exe
2860	1a4a3457cb3a57ecb7cafcad9011e18a0959d2071620048a7815483fa37fe758.exe

C:\Users\Admin\AppData\Local\Temp\1a4a3457cb3a57ecb7cafcad9011e18a0959d2071620048a7815483fa37fe758.exe
"C:\Users\Admin\AppData\Local\Temp\1a4a3457cb3a57ecb7cafcad9011e18a0959d2071620048a7815483fa37fe758.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads