Analysis

  • max time kernel
    73s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 10:07

General

  • Target

    5e80cef604a735e68c96159561b816076e9d7b21fb57be0be2c61e872cd5080c.exe

  • Size

    4.2MB

  • MD5

    d5df01ac28fd85f172bc6f110617d75a

  • SHA1

    a2dcc19d88ba09da63a3683cff99e84e5e340060

  • SHA256

    5e80cef604a735e68c96159561b816076e9d7b21fb57be0be2c61e872cd5080c

  • SHA512

    1964bb1a660809bdca9d564de3a9daf662cbf9e76def4c5799eed001c8ee6a3d90d7267b3e138bc2f9982a2dc1e43db235ca218f6a05200713478d85ae10200f

  • SSDEEP

    98304:m5tEsszPCGTs3RAW8dYBHspDfuvmeNPLRcPyE:TssbCGo3yW8dLfZeNjR2

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e80cef604a735e68c96159561b816076e9d7b21fb57be0be2c61e872cd5080c.exe
    "C:\Users\Admin\AppData\Local\Temp\5e80cef604a735e68c96159561b816076e9d7b21fb57be0be2c61e872cd5080c.exe"
    1⤵
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1688

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Norton\FSDErMgt\ErrMgmt\SQCLIENT.dat

          Filesize

          2KB

          MD5

          f9c882e704789877c1a01fca257fa2c1

          SHA1

          99a961b1e6db149e98a89075163b41496015375d

          SHA256

          fe378348485d1444160a6240105027f29ce59a26e24150da9824be223ccc0b37

          SHA512

          26ea9e0b7bc4ab0fb8e22b2c5893834dc5c989d66d86c436a98d6374e84e17841d26d708d320c6519853137e91d36ff712044ea3458806c3ed79f8ed05c228f0

        • C:\ProgramData\Norton\FSDErMgt\ErrMgmt\SQCLIENT.dat

          Filesize

          3KB

          MD5

          896fb39ed22e18aded3643699112f7e9

          SHA1

          1dc10db56f49d699654896614b8580871b514760

          SHA256

          c19fa6bad562a7bfb6c0f090f195b7c6b2dee79c1f0bed6a39c37faec6d5d665

          SHA512

          80ca520eacf685e559b6da3d9bce5420385178e7ca0242486b4e1aab266fc02efbfe00a9e9e88516e35a59e6549bc52ca8fe78f3d5e8e0877a622238218d8e6a

        • C:\ProgramData\Norton\FSDErMgt\ErrMgmt\SQCLIENT.dat

          Filesize

          4KB

          MD5

          12565b3eb7451281c47897726e128e92

          SHA1

          3d54eda3043676be214566b4752f08554aa3bff8

          SHA256

          803ad072683b7c4a365140526b1e40b2333792e9dad58e9146b346d4766f6885

          SHA512

          465a2c2ae2d2d306e1d13ed6550ab14a19512d882f6b502411648c2c9f6b111449d1672a279c2770922257e2fbde470fc76f3629c700a377f5ab210d045f8234

        • C:\ProgramData\Norton\{086A63F0-6B13-4F29-9695-134E7A01E963}\LC.INI

          Filesize

          157B

          MD5

          c8a83b0d4a08a7a824f7a055d360de87

          SHA1

          92431af1f59acfa920dc77d72a1d632bca2eaf54

          SHA256

          388429a65043e38474c1b7db7334757eff2babfc77dd15e68367da7079141995

          SHA512

          f46c73a9fa7f02579adae86d5e37db79883dd14a81375cb2b13cbfacc69305e014d35cb45374d5f2cd1defeab8d03826387f4f06c6c6eb9ef8f294a4dccec1d2

        • memory/1688-9-0x0000000000270000-0x0000000000271000-memory.dmp

          Filesize

          4KB

        • memory/1688-59-0x0000000000270000-0x0000000000271000-memory.dmp

          Filesize

          4KB