Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/11/2024, 17:02
General
-
Target
5ca500b7bf981e9f0d8db3a521f187e78983c3c6aea8f3f7519554451a60f623.exe
-
Size
2.8MB
-
MD5
ffb3530b3c41381f4cfdcb0b2b520c69
-
SHA1
7f1cc08cb2575813d8b7f18f87c604ea9d3fd839
-
SHA256
5ca500b7bf981e9f0d8db3a521f187e78983c3c6aea8f3f7519554451a60f623
-
SHA512
2a13cbc09241b4c56c79a9a3e3393c9a459d8fbe1ed3735acb39ee781b6a9d4368c330bb8453f4f278a981ef73291bfc655d078686cffc738cc0ef7c842d1c68
-
SSDEEP
49152:i3kP04qO/wNaSxxGdqwAyFVbpYIwHJUXD0Lj3ixAZrUm+Yt1F5HS2QPTfwQPTfhv:r0G/wNagxhwbFVbpYIwHJUXFxAZjtt15
Score
10/10
Malware Config
Signatures
-
UAC bypass 3 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ca500b7bf981e9f0d8db3a521f187e78983c3c6aea8f3f7519554451a60f623.exe"C:\Users\Admin\AppData\Local\Temp\5ca500b7bf981e9f0d8db3a521f187e78983c3c6aea8f3f7519554451a60f623.exe"1⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification