f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe
Size

11KB
MD5

a0a010c6bc3aeca4c61b88d83b7bc4fc
SHA1

82bff34d56ae4d659f32197b485681b3bee58b55
SHA256

f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b
SHA512

33c08b1a138fcf4d24f6a124d39d6ce937cd2f4a49c2a5076c4da64f14bf61e104e430bc92e672508c49d95ce2f4663bab4d77e36ff83a518a0a2ef0925ba0c1
SSDEEP

192:zow9iG8qkoI0xF5H2nQfmG4NlUeKrfBzEL6:HkJKJGQP4NSeoBzEL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	376	f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe

C:\Users\Admin\AppData\Local\Temp\f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe
"C:\Users\Admin\AppData\Local\Temp\f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-0-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/376-1-0x0000000001360000-0x0000000001368000-memory.dmp

Filesize
32KB

Download
memory/376-2-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/376-3-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download