Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2024 09:24

General

  • Target

    54718ab7a93e2a2a00e355a58dfa1d4700ec08e925703bb72d7a25dd01973e9a.exe

  • Size

    2.2MB

  • MD5

    ebbb525d514b2725487ea56391c67268

  • SHA1

    2e4a7ca7d6029750336a59531fa92bb863200c8d

  • SHA256

    54718ab7a93e2a2a00e355a58dfa1d4700ec08e925703bb72d7a25dd01973e9a

  • SHA512

    b645c9b13ccd96f7fc02b5eccf6f11930baa28c174efb061c55742044e9d8079fc5d8d271b006f8c6369ac573dc7f4d222aa0d5c3e54f9ca78338f083ee546dd

  • SSDEEP

    49152:Gll+JYqBe/XaZ9VMaAsRr1CwHLSJ1xGpocF8oWrwOcbRKF6Buu0:NJ1YXw11CwHLY1YOo4wBg

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\54718ab7a93e2a2a00e355a58dfa1d4700ec08e925703bb72d7a25dd01973e9a.exe
    "C:\Users\Admin\AppData\Local\Temp\54718ab7a93e2a2a00e355a58dfa1d4700ec08e925703bb72d7a25dd01973e9a.exe"
    1⤵
    • Drops startup file
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 660
      2⤵
      • Program crash
      PID:3332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2072-0-0x000000007443E000-0x000000007443F000-memory.dmp

    Filesize

    4KB

  • memory/2072-1-0x0000000000C80000-0x0000000000EBC000-memory.dmp

    Filesize

    2.2MB

  • memory/2072-2-0x0000000074430000-0x0000000074B1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2072-3-0x0000000005190000-0x000000000539C000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-4-0x00000000064D0000-0x00000000066DC000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-5-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-12-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-6-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-22-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-20-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-18-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-16-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-14-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-10-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-8-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-26-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-52-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-60-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-66-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-64-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-62-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-58-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-56-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-54-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-50-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-48-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-46-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-44-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-42-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-40-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-38-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-36-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-34-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-32-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-30-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-28-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-24-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-68-0x00000000064D0000-0x00000000066D6000-memory.dmp

    Filesize

    2.0MB

  • memory/2072-1079-0x0000000074430000-0x0000000074B1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2072-1080-0x0000000006B10000-0x0000000006C8E000-memory.dmp

    Filesize

    1.5MB

  • memory/2072-1081-0x0000000000AF0000-0x0000000000B3C000-memory.dmp

    Filesize

    304KB

  • memory/2072-1082-0x000000007443E000-0x000000007443F000-memory.dmp

    Filesize

    4KB

  • memory/2072-1083-0x0000000074430000-0x0000000074B1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2072-1084-0x0000000002300000-0x0000000002354000-memory.dmp

    Filesize

    336KB

  • memory/2072-1087-0x0000000074430000-0x0000000074B1E000-memory.dmp

    Filesize

    6.9MB