751c7f215a6f62dd3d95bf1d7d16f6ef9a1326a8db3cfe896a54be8f7f725c1a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/10/2024, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
General terms and conditions of sale - Valid from 10202024 to 12312024.exe
Size 70.0MB
Sample241023-hsprpayfml
SHA256 751c7f215a6f62dd3d95bf1d7d16f6ef9a1326a8db3cfe896a54be8f7f725c1a
MD5 ca7fa155e806b14ad80b11a676e31fe6
SHA1 0bdce3f4294fa9fa1e3c8b684918341f939a8fc9
SHA512 bc608c8f808f8d6c23dbcbaa9bd8d1c09c3b1430aa95d7a8919f6cec5ba6b032dc2ab8789fe8b22af9c698f46eed951b110e64f567589a12328fe62e8516bea4
SSDEEP 24576:ffmMv6Ckr7Mny5QLTFA1tMWGQCTWN4JJP8Mc:f3v+7/5QLxmtbkc47Pr
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 2932	2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	General terms and conditions of sale - Valid from 10202024 to 12312024.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe
2932	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe
2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe
2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2932	2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	30
PID 2064 wrote to memory of 2932	2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	30
PID 2064 wrote to memory of 2932	2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	30
PID 2064 wrote to memory of 2932	2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	30
PID 2064 wrote to memory of 2932	2064	General terms and conditions of sale - Valid from 10202024 to 12312024.exe	30

C:\Users\Admin\AppData\Local\Temp\General terms and conditions of sale - Valid from 10202024 to 12312024.exe
"C:\Users\Admin\AppData\Local\Temp\General terms and conditions of sale - Valid from 10202024 to 12312024.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\General terms and conditions of sale - Valid from 10202024 to 12312024.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-2-0x00000000037C0000-0x00000000039C0000-memory.dmp

Download

memory/2932-3-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2932-4-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2932-5-0x00000000009D0000-0x0000000000CD3000-memory.dmp

Download

memory/2932-6-0x0000000000400000-0x0000000000447000-memory.dmp

Download