Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 10:27

General

  • Target

    1fadf1c1dce0bea5d0dbbe3d5f59a0cd69c713ba7fa2677d66dfaf8e6ffe30d2.exe

  • Size

    1.1MB

  • MD5

    93c5c7bbe7cf155b0bfc0daee573f6ef

  • SHA1

    70bba9d4d748ca67fe0d7b8a9f426a7bb09c10b5

  • SHA256

    1fadf1c1dce0bea5d0dbbe3d5f59a0cd69c713ba7fa2677d66dfaf8e6ffe30d2

  • SHA512

    524a0b7624186593af0164d72f22fbeffad9c5eac4f157cb5ad601c655e61db39a3143e5dc43c0f2bd18f1fca4f495f032b5572d4c4d588ee43dbc59e1175904

  • SSDEEP

    24576:AY2H2e6Tyrbtu1608ync1zwUGvdVILdPDF8n8vUy+MxLQ+HwK8Ae7:582l51HnsDmVQPDFWsb7HyB

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fadf1c1dce0bea5d0dbbe3d5f59a0cd69c713ba7fa2677d66dfaf8e6ffe30d2.exe
    "C:\Users\Admin\AppData\Local\Temp\1fadf1c1dce0bea5d0dbbe3d5f59a0cd69c713ba7fa2677d66dfaf8e6ffe30d2.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1104

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1104-2-0x0000000001E70000-0x0000000001EB6000-memory.dmp

          Filesize

          280KB

        • memory/1104-1-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-0-0x0000000074C00000-0x0000000074C4A000-memory.dmp

          Filesize

          296KB

        • memory/1104-6-0x0000000000340000-0x0000000000341000-memory.dmp

          Filesize

          4KB

        • memory/1104-7-0x0000000000022000-0x0000000000061000-memory.dmp

          Filesize

          252KB

        • memory/1104-5-0x0000000001E70000-0x0000000001EB6000-memory.dmp

          Filesize

          280KB

        • memory/1104-4-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-3-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-10-0x0000000076C60000-0x0000000076CA7000-memory.dmp

          Filesize

          284KB

        • memory/1104-12-0x0000000074D00000-0x0000000074D09000-memory.dmp

          Filesize

          36KB

        • memory/1104-11-0x0000000076C00000-0x0000000076C57000-memory.dmp

          Filesize

          348KB

        • memory/1104-9-0x0000000074EE0000-0x0000000074F8C000-memory.dmp

          Filesize

          688KB

        • memory/1104-14-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-13-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-15-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-17-0x0000000075290000-0x00000000753EC000-memory.dmp

          Filesize

          1.4MB

        • memory/1104-18-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-19-0x00000000753F0000-0x000000007547F000-memory.dmp

          Filesize

          572KB

        • memory/1104-20-0x00000000741D0000-0x0000000074250000-memory.dmp

          Filesize

          512KB

        • memory/1104-21-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-22-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-23-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-24-0x0000000075E70000-0x0000000076ABA000-memory.dmp

          Filesize

          12.3MB

        • memory/1104-26-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-25-0x0000000001E70000-0x0000000001EB6000-memory.dmp

          Filesize

          280KB

        • memory/1104-27-0x0000000073B70000-0x0000000073B87000-memory.dmp

          Filesize

          92KB

        • memory/1104-28-0x0000000000022000-0x0000000000061000-memory.dmp

          Filesize

          252KB

        • memory/1104-29-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-30-0x0000000076CB0000-0x0000000076CE5000-memory.dmp

          Filesize

          212KB

        • memory/1104-31-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-32-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-33-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-42-0x0000000074A40000-0x0000000074ABD000-memory.dmp

          Filesize

          500KB

        • memory/1104-41-0x0000000075290000-0x00000000753EC000-memory.dmp

          Filesize

          1.4MB

        • memory/1104-39-0x0000000076C00000-0x0000000076C57000-memory.dmp

          Filesize

          348KB

        • memory/1104-36-0x0000000074EE0000-0x0000000074F8C000-memory.dmp

          Filesize

          688KB

        • memory/1104-34-0x0000000076C60000-0x0000000076CA7000-memory.dmp

          Filesize

          284KB

        • memory/1104-40-0x0000000074C00000-0x0000000074C4A000-memory.dmp

          Filesize

          296KB

        • memory/1104-50-0x0000000077430000-0x0000000077435000-memory.dmp

          Filesize

          20KB

        • memory/1104-44-0x0000000074350000-0x0000000074A3E000-memory.dmp

          Filesize

          6.9MB

        • memory/1104-49-0x0000000074B50000-0x0000000074B63000-memory.dmp

          Filesize

          76KB

        • memory/1104-47-0x00000000741D0000-0x0000000074250000-memory.dmp

          Filesize

          512KB

        • memory/1104-46-0x0000000074CF0000-0x0000000074CF3000-memory.dmp

          Filesize

          12KB

        • memory/1104-45-0x0000000074250000-0x0000000074345000-memory.dmp

          Filesize

          980KB

        • memory/1104-51-0x0000000073C30000-0x0000000073D65000-memory.dmp

          Filesize

          1.2MB

        • memory/1104-52-0x000000006F2E0000-0x000000006F429000-memory.dmp

          Filesize

          1.3MB

        • memory/1104-53-0x0000000073BB0000-0x0000000073C28000-memory.dmp

          Filesize

          480KB

        • memory/1104-57-0x0000000076DD0000-0x0000000076DD6000-memory.dmp

          Filesize

          24KB

        • memory/1104-56-0x0000000076CB0000-0x0000000076CE5000-memory.dmp

          Filesize

          212KB

        • memory/1104-54-0x000000006F210000-0x000000006F2DA000-memory.dmp

          Filesize

          808KB

        • memory/1104-58-0x000000006CF50000-0x000000006D038000-memory.dmp

          Filesize

          928KB

        • memory/1104-59-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-60-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-61-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-62-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB

        • memory/1104-73-0x0000000074350000-0x0000000074A3E000-memory.dmp

          Filesize

          6.9MB

        • memory/1104-88-0x0000000000020000-0x0000000000265000-memory.dmp

          Filesize

          2.3MB