20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe
Size

1.1MB
MD5

41e734c6949869fe5c9ef361a86b0bbf
SHA1

2a6d4f570abc4030393e2acd0e1d311148cd94ac
SHA256

20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281
SHA512

2f060af40b7551d2e9599da90f313a4a744a03fe7877c7dd90ba20138eae8382103e752069ee399c59524d7515892cd6ca7acf66d0052697f48ec641ab537fea
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qw:CcaClSFlG4ZM7QzMH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3056	20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3056	20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3056	20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3056	20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe
3056	20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1972	3056	20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe	30
PID 3056 wrote to memory of 1972	3056	20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe	30
PID 3056 wrote to memory of 1972	3056	20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe	30
PID 3056 wrote to memory of 1972	3056	20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe	30

C:\Users\Admin\AppData\Local\Temp\20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe
"C:\Users\Admin\AppData\Local\Temp\20f76d53efd59880487ea546a47379ef9c1faca0c5cd70600bc90d659fa5e281.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
b8aec766c5b90855e4b52b637364e025

SHA1
6b55eae36800d38610da8470305a97384c629f10

SHA256
871e45bfa7520effb8426243c8adcc9ba1dec492826aa020fc52f81760bf3782

SHA512
77ca39f27b295b909dce955d468db34e2db39a6e7f362a6d49f4b78047aecb24295164724e18932b3724d8d25eb3010fbde37e7948f09542ce24088110da02b9

Download Submit
memory/3056-8-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download