Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 07:16
Behavioral task
behavioral1
Sample
17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe
Resource
win10v2004-20241007-en
General
-
Target
17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe
-
Size
469KB
-
MD5
0264973bb3393bdf7491f187453125b9
-
SHA1
1dc322f633b7bf9f53efccdacd160edde8eb788b
-
SHA256
16633659b34e72eca765b68ad3119bf4505360863458667d7e93cbfdd2c08ce2
-
SHA512
d47d5223a529d6fd269d00c22f3da95223f3fb7c93b6967e9236735780ac5cbe3c188ba45d9f229275d330857c47f0a9c77409d3ab62c97e2955fe641bffb66b
-
SSDEEP
12288:Omnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSiCn9:2iLJbpI7I2WhQqZ7iC9
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exepid process 772 17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\17315685090dcee4037f17ce33a7194fcbb024dc89b01756f06f9a965f66da9d4d9b33569e290.dat-decoded.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5520b40238570c8185ece292c93c79e35
SHA12d31ca13483654e5e92a3e6d2308b1db18947341
SHA2564509746ed728171284b00ee0380342185ee0921e59a8069b4066ef73b4248114
SHA512b317d92635ffcc71c9a99cfbedef738fe29a83e2bc918fd6234985b5cfb2bcec84a937d67106eee839a596591b9f57057c418639884cd1a9f2f89a871c6f14fb