Analysis
-
max time kernel
30s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18/10/2024, 08:55
General
-
Target
7977e38fed339ab411d2b7924b49a2478987aade8d6fca6144d481c3a1591351N.exe
-
Size
164KB
-
MD5
3fe7c9f01e5585217ec6a5b9ea94ea90
-
SHA1
d139af1c8b537eb1f17fe1ec538fce0b09d3acb1
-
SHA256
7977e38fed339ab411d2b7924b49a2478987aade8d6fca6144d481c3a1591351
-
SHA512
918ef7a9e7d48787340da9f908529252104a622ab3cff0538583501c2e8289d8a9dfe7e146b6117bd8e4fd3d0ec99fdf484eab15a80071e4e23384fae9f09e5b
-
SSDEEP
1536:uZJSmOK0Tn1EIIQoKkbsi2diCnGBY6nq9t6bLIZGwWuy6tU5t5918oJnp:uZJS7K0jsAIY6nCtY3wN1i6oJp
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7977e38fed339ab411d2b7924b49a2478987aade8d6fca6144d481c3a1591351N.exe"C:\Users\Admin\AppData\Local\Temp\7977e38fed339ab411d2b7924b49a2478987aade8d6fca6144d481c3a1591351N.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
-
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
100KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
84KB
-
Filesize
28KB