03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe
Size

1.1MB
MD5

3c96478d43a624d9414f87dff00cfac4
SHA1

58a6603b7c39cc84d4872cb93504985aec1df69b
SHA256

03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60
SHA512

4bae6a6d420d2cc78c33b8cf14cbb02d7f2c656a251721ff5689f25483198a8bf990bb6f99581608ad1cf50cc73ae2f078879231fb15c60e8ef549a7ce282ec3
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qs:CcaClSFlG4ZM7QzMb

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2792	03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2792	03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2792	03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe
2792	03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2712	2792	03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe	30
PID 2792 wrote to memory of 2712	2792	03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe	30
PID 2792 wrote to memory of 2712	2792	03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe	30
PID 2792 wrote to memory of 2712	2792	03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe	30

C:\Users\Admin\AppData\Local\Temp\03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe
"C:\Users\Admin\AppData\Local\Temp\03dea25279113eedc12cc0df548167e3c68ee949b23cd4e932f39b8a4f934c60.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
b9928e9e3694ab1476e2c892104fc019

SHA1
8c992290ed682634cfda6ff41e99013bcecbc0f6

SHA256
3410865ee82486ee2f661127f1267c6c487ab2f48b418da93675a11ed94ace3e

SHA512
4aa0dcc5cc5789d091f1271b812f5a9c090690d57d547d1d2a908fd2353612a6b5cc48326a8dfbf3e84dcc0b157296f25911d9cc235e490c12e9c36a4c27cfc5

Download Submit
memory/2792-8-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download