e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe
Size

1.1MB
MD5

bd621ce42c293aac7a7170a3e41aa44b
SHA1

19c4cba074a2893cad7bf33d81b3cb25fe129571
SHA256

e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8
SHA512

b64d893a39b5a272d9e588e8353585f12ddba0a8ba8ef2cdbae82aeca84cec97773c0d13562bc7eb2e0f8d097c39828f9b98fbd8ac12e4c6d1d9a4b9be23ae48
SSDEEP

24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyR1:g5ApamAUAQ/lG4lBmFAvZ1

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2112	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2112	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2112	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe
2112	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2816	2112	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe	30
PID 2112 wrote to memory of 2816	2112	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe	30
PID 2112 wrote to memory of 2816	2112	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe	30
PID 2112 wrote to memory of 2816	2112	e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe	30

C:\Users\Admin\AppData\Local\Temp\e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe
"C:\Users\Admin\AppData\Local\Temp\e7efc027a42552c90431b4c30968ef55044789d61fb273074019b484cf3cc6c8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
025b7b2a63df51e7a07b44abb831357d

SHA1
13dadb4ab93d915cae658fed9f9b3eef7a844f83

SHA256
a7d1f05d2e2b0d67052f613934dbc6c36c6c9cec82f49e3b00ee3726fb7b072f

SHA512
8283255b1549d32b0cc7d4f34a0f73de388b38cb610add916b7f5963211f4be67be90c8f38fd4df875792f70de67cdf47cbb34d2b4d98dd60e43c2d6a762b589

Download Submit
memory/2112-8-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download