b3ffba5da1500b5a2645ef162fbfa00f4fb4020d539022daef7b9c49e81531c0

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/11/2024, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arrival notice.exe
Size 805KB
Sample241102-dkngfazmdj
SHA256 b3ffba5da1500b5a2645ef162fbfa00f4fb4020d539022daef7b9c49e81531c0
MD5 673605dd607d73c13509e2876fdcd493
SHA1 395ad546d900f4f1c17d2f8ebf2e98fbe7e40b59
SHA512 e76c444360e17c46fecee879e454a089d8a79225c5191e23568ba62ff81a872ab23cd031ab4218f78083b479bfe4d93acc3eaa49a1b3455d429a6d1683d0f912
SSDEEP 12288:ZKtFRrXQ9TZwenjcQThNWtxfBMHjO1jk1fqoaaxhxDdC4gBYdpeXFFKwA2CQJqg1:swnjdT3W6Su1flb/5qFVA1QJLvG
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 2740	1852	arrival notice.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arrival notice.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2740	RegSvcs.exe
2740	RegSvcs.exe
2740	RegSvcs.exe
2740	RegSvcs.exe
2740	RegSvcs.exe
2740	RegSvcs.exe
2740	RegSvcs.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2740	1852	arrival notice.exe	31
PID 1852 wrote to memory of 2740	1852	arrival notice.exe	31
PID 1852 wrote to memory of 2740	1852	arrival notice.exe	31
PID 1852 wrote to memory of 2740	1852	arrival notice.exe	31
PID 1852 wrote to memory of 2740	1852	arrival notice.exe	31
PID 1852 wrote to memory of 2740	1852	arrival notice.exe	31
PID 1852 wrote to memory of 2740	1852	arrival notice.exe	31
PID 1852 wrote to memory of 2740	1852	arrival notice.exe	31
PID 1852 wrote to memory of 2740	1852	arrival notice.exe	31
PID 1852 wrote to memory of 2740	1852	arrival notice.exe	31

C:\Users\Admin\AppData\Local\Temp\arrival notice.exe
"C:\Users\Admin\AppData\Local\Temp\arrival notice.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1852-13-0x0000000074240000-0x000000007492E000-memory.dmp

Download

memory/1852-0-0x000000007424E000-0x000000007424F000-memory.dmp

Download

memory/1852-2-0x0000000074240000-0x000000007492E000-memory.dmp

Download

memory/1852-3-0x0000000000430000-0x000000000044C000-memory.dmp

Download

memory/1852-4-0x000000007424E000-0x000000007424F000-memory.dmp

Download

memory/1852-5-0x0000000074240000-0x000000007492E000-memory.dmp

Download

memory/1852-1-0x00000000001B0000-0x0000000000280000-memory.dmp

Download

memory/1852-6-0x0000000000350000-0x00000000003DE000-memory.dmp

Download

memory/2740-8-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2740-11-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2740-7-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2740-12-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2740-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2740-14-0x0000000000950000-0x0000000000C53000-memory.dmp

Download

memory/2740-15-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2740-16-0x0000000000400000-0x0000000000447000-memory.dmp

Download