3a2e31f2844df5cb91eedbf24c0b93de4b0aa08525f733132c2bce0d7ab81acc

Resubmissions

10-11-2024 21:28

241110-1bhk6avgrr 10

Analysis

max time kernel
137s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

006e75ccf30448182c69a7f7bc7a4308caa78a87e6d834926599ce6b11e222e6.exe
Size

17KB
MD5

a61cf98f6e6632ad9bd479099d9d927b
SHA1

e7ae73b6d1d13880987cf3a5c521d29cccee13b1
SHA256

006e75ccf30448182c69a7f7bc7a4308caa78a87e6d834926599ce6b11e222e6
SHA512

943dfac58f3de927537b223bc342b91a243e2928b83c9cfba2dd2e1df7ac11a7df3ccb977cabd1b4f4f8516c22dcf79c3c0d61009d0cf96e666264ac9dd0d923
SSDEEP

96:Zsxdyk6qzopysGLr/AmXJ+D1sAUisxhlkmkJpW1ss8jn5VyoFELLSEzNt:Z+jop6Lr/Am5ayBiehlkhJzjfyoWau

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

006e75ccf30448182c69a7f7bc7a4308caa78a87e6d834926599ce6b11e222e6.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	006e75ccf30448182c69a7f7bc7a4308caa78a87e6d834926599ce6b11e222e6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

006e75ccf30448182c69a7f7bc7a4308caa78a87e6d834926599ce6b11e222e6.exe

description pid process

Token: SeDebugPrivilege 3964 006e75ccf30448182c69a7f7bc7a4308caa78a87e6d834926599ce6b11e222e6.exe

description	pid	process
Token: SeDebugPrivilege	3964	006e75ccf30448182c69a7f7bc7a4308caa78a87e6d834926599ce6b11e222e6.exe

C:\Users\Admin\AppData\Local\Temp\006e75ccf30448182c69a7f7bc7a4308caa78a87e6d834926599ce6b11e222e6.exe
"C:\Users\Admin\AppData\Local\Temp\006e75ccf30448182c69a7f7bc7a4308caa78a87e6d834926599ce6b11e222e6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3964-0-0x0000000074CDE000-0x0000000074CDF000-memory.dmp

Filesize
4KB

Download
memory/3964-1-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download
memory/3964-2-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/3964-3-0x0000000074CDE000-0x0000000074CDF000-memory.dmp

Filesize
4KB

Download
memory/3964-4-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download