Analysis
- max time kernel
142s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
22/10/2024, 01:40
Behavioral task
behavioral1
Sample
Receipt.exe
Resource
win7-20240903-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Receipt.exe
Resource
win10v2004-20241007-en
3 signatures
150 seconds
General
- Target Receipt.exe
- Size 452KB
- Sample241022-b3nttazake
- SHA256 b25969ec654bac567f82da096178825f2e7b89e03a9e4f7ac6ae2ae98aaa6b08
- MD5 d4a26c141b32a5d61efbe2e7f69c0d00
- SHA1 b66b6969264564861d5121a6a822b87de385ae91
- SHA512 96dc77245fa41246c17f98fed9dd2b494b52c2d59e117aaff1446f4827d9114047cc33d5c04f4c38bad0958fc35db43287dd884ae24443b12e3eb616e80c63f9
- SSDEEP 12288:rU0ZFgf1KgNxKBAwz05323yvMdb2U3jYKkJj6GmZU:rTZFQKiR23geb2UzYb6nZ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Receipt.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3288 Receipt.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3288 Receipt.exe