09c91862d6e40c74f6edc233440b5f691d498ede6fb00bb43d309ca24e4e67b9

Analysis

max time kernel
839s
max time network
845s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
Size

24KB
MD5

8a1225f47aa9f0673c32983f1b2b2c5b
SHA1

742f2364f2d5f10385b56c22ecf17a3cdcc53346
SHA256

9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291
SHA512

d633dc2caa28a0a782108b9d47d43322c6f1d95c82903219b4b83eb491691217916e7eee35a0eb206aae2937523896e538141e524b396c2ae7210ec8f8238827
SSDEEP

96:/lx5KHYFNV+Vvl/iABo1FYXGgn2PUkWf2BtvXrs2aoE8y79h9jSUyrW9EhN:/TzmVvl/vaKdnvJeBtvXrsr352UyCEh

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 24 IoCs

Processes:

9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe

description	ioc	process
File created	C:\Program Files\CopySave.inf.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\SuspendCopy.mpa.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\SubmitRegister.DVR.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\CompressMove.mp2.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\desktop.ini.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\MoveEdit.vssm.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\NewUndo.vdw.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\SelectShow.mp2v.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\StopGet.gif.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\ConvertToStart.wpl.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\DebugReset.vstx.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\RedoWait.pdf.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\RepairImport.docx.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\SplitPing.M2V.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files (x86)\desktop.ini.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\SplitGroup.ppsx.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\SwitchUnlock.3gp2.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\DisableReset.AAC.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\DismountPublish.avi.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\GrantReset.ico.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\LockPush.ppt.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\PingSelect.html.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\PublishRegister.potm.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Program Files\UnblockNew.wmx.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe

Drops file in Windows directory 29 IoCs

Processes:

9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe

description	ioc	process
File created	C:\Windows\setupact.log.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\PFRO.log.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\notepad.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\fveupdate.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\Starter.xml.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\DtcInstall.log.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\bootstat.dat.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\explorer.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\setuperr.log.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\win.ini.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\winhlp32.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\bfsvc.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\TSSysprep.log.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\twain_32.dll.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\msdfmap.ini.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\system.ini.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\splwow64.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\twain.dll.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\Ultimate.xml.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\WMSysPr9.prx.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\write.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\regedit.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\hh.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\mib.bin.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\twunk_16.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\twunk_32.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\WindowsShell.Manifest.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\WindowsUpdate.log.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
File created	C:\Windows\HelpPane.exe.sb	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe

pid process

2248 9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe

pid	process
2248	9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe

C:\Users\Admin\AppData\Local\Temp\9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe
"C:\Users\Admin\AppData\Local\Temp\9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\RepairImport.docx.sb

Filesize
5KB

MD5
e233540c0dd93f4cf95aac371764a63a

SHA1
4fb7bd38b8a157e90d449eebedb7d448a2f0e58a

SHA256
62f90dbdf4c3a0e4d066acd630cc8445132280f474241e649ec6a83dba3e3db0

SHA512
ba5dc197cab256975b2c133da3cc40d614dc2501fba7ad8ab2229ce134ea878b031dfebac19d3f7cc7d4df4a775a47a3079ee0c898e58ba8ac2757e4def6dcaa

Download Submit