a2211a28be3ab16c87a509d902b542dc181376f5419be66a727d4082c460bd46

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/10/2024, 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ 24201007.pdf.scr
Size

6KB
MD5

c3faec92c8d98520e0cdab9ba05d1a3f
SHA1

39a025bf0c0f94a0a269e72700a9f0245a349b36
SHA256

956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9
SHA512

183ecac23b10da4bc48cacef135fbc647796b2764804f43f91b5a49b09a0a535d23700afa7d469a816b94206858513c9d0c08fc46eab3075f21b1ea6e12d3dd3
SSDEEP

96:LQAm7EhsIHRpY5J2jRZ4ph5CkN/jo4zNt:cAm7lIxEmRZOh5hp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ 24201007.pdf.scr

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	RFQ 24201007.pdf.scr

C:\Users\Admin\AppData\Local\Temp\RFQ 24201007.pdf.scr
"C:\Users\Admin\AppData\Local\Temp\RFQ 24201007.pdf.scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Filesize
4KB

Download
memory/2400-1-0x0000000001230000-0x0000000001238000-memory.dmp

Filesize
32KB

Download
memory/2400-2-0x0000000074A00000-0x00000000750EE000-memory.dmp

Filesize
6.9MB

Download
memory/2400-3-0x0000000074A00000-0x00000000750EE000-memory.dmp

Filesize
6.9MB

Download