Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-11-2024 21:07
Static task
static1
Behavioral task
behavioral1
Sample
270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe
Resource
win10v2004-20241007-en
General
-
Target
270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe
-
Size
113KB
-
MD5
7cf417d06a24c1ade73ec6d8ae589077
-
SHA1
128516790f9c6d8ac1d33a9f1f2b854162d94942
-
SHA256
270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8
-
SHA512
3f5615b04489cfc755e19efc30fe619026dfacd250bb1c1677e1c55ceb6f69a80d0f05760c157696985e1090c34e8e403b453e5680fb981f274bdd66e2fcb5bb
-
SSDEEP
3072:RSb0MKWY3tfR2y+/ESH7V3wy3OcpN4LBzl:44JWGJ+/ESx3wy+c34LBZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 1640 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 28 PID 2288 wrote to memory of 1640 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 28 PID 2288 wrote to memory of 1640 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 28 PID 2288 wrote to memory of 1640 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 28 PID 2288 wrote to memory of 1724 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 29 PID 2288 wrote to memory of 1724 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 29 PID 2288 wrote to memory of 1724 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 29 PID 2288 wrote to memory of 1724 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 29 PID 2288 wrote to memory of 3008 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 30 PID 2288 wrote to memory of 3008 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 30 PID 2288 wrote to memory of 3008 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 30 PID 2288 wrote to memory of 3008 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 30 PID 2288 wrote to memory of 2980 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 33 PID 2288 wrote to memory of 2980 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 33 PID 2288 wrote to memory of 2980 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 33 PID 2288 wrote to memory of 2980 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 33 PID 2288 wrote to memory of 2656 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 34 PID 2288 wrote to memory of 2656 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 34 PID 2288 wrote to memory of 2656 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 34 PID 2288 wrote to memory of 2656 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 34 PID 2288 wrote to memory of 1720 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 35 PID 2288 wrote to memory of 1720 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 35 PID 2288 wrote to memory of 1720 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 35 PID 2288 wrote to memory of 1720 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 35 PID 2288 wrote to memory of 2404 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 36 PID 2288 wrote to memory of 2404 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 36 PID 2288 wrote to memory of 2404 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 36 PID 2288 wrote to memory of 2404 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 36 PID 2288 wrote to memory of 2676 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 37 PID 2288 wrote to memory of 2676 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 37 PID 2288 wrote to memory of 2676 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 37 PID 2288 wrote to memory of 2676 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 37 PID 2288 wrote to memory of 2464 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 38 PID 2288 wrote to memory of 2464 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 38 PID 2288 wrote to memory of 2464 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 38 PID 2288 wrote to memory of 2464 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 38 PID 2288 wrote to memory of 1536 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 39 PID 2288 wrote to memory of 1536 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 39 PID 2288 wrote to memory of 1536 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 39 PID 2288 wrote to memory of 1536 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 39 PID 2288 wrote to memory of 1040 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 40 PID 2288 wrote to memory of 1040 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 40 PID 2288 wrote to memory of 1040 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 40 PID 2288 wrote to memory of 1040 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 40 PID 2288 wrote to memory of 1736 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 41 PID 2288 wrote to memory of 1736 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 41 PID 2288 wrote to memory of 1736 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 41 PID 2288 wrote to memory of 1736 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 41 PID 2288 wrote to memory of 2868 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 42 PID 2288 wrote to memory of 2868 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 42 PID 2288 wrote to memory of 2868 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 42 PID 2288 wrote to memory of 2868 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 42 PID 2288 wrote to memory of 2196 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 43 PID 2288 wrote to memory of 2196 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 43 PID 2288 wrote to memory of 2196 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 43 PID 2288 wrote to memory of 2196 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 43 PID 2288 wrote to memory of 976 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 44 PID 2288 wrote to memory of 976 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 44 PID 2288 wrote to memory of 976 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 44 PID 2288 wrote to memory of 976 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 44 PID 2288 wrote to memory of 2604 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 45 PID 2288 wrote to memory of 2604 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 45 PID 2288 wrote to memory of 2604 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 45 PID 2288 wrote to memory of 2604 2288 270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:1640
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:1724
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:3008
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2980
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2656
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:1720
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2404
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2676
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2464
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:1536
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:1040
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:1736
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2868
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2196
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:976
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2604
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:1996
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2444
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2036
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2788
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:2820
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:448
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:608
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"2⤵PID:3028
-