Overview
overview
10Static
static
3abf3620108...17.exe
windows7-x64
10abf3620108...17.exe
windows10-2004-x64
10$APPDATA/u...rd.exe
windows7-x64
3$APPDATA/u...rd.exe
windows10-2004-x64
3$APPDATA/u...gf.exe
windows7-x64
3$APPDATA/u...gf.exe
windows10-2004-x64
3$APPDATA/u...ow.exe
windows7-x64
3$APPDATA/u...ow.exe
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
abf36201080f1e36f9f91aa8418aa5a4c23a777c82075baa171b9f2d7d963017.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
abf36201080f1e36f9f91aa8418aa5a4c23a777c82075baa171b9f2d7d963017.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$APPDATA/uurhngf/htfrahrd.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$APPDATA/uurhngf/htfrahrd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$APPDATA/uurhngf/uurhngf.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$APPDATA/uurhngf/uurhngf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$APPDATA/uurhngf/uurhngfbrow.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$APPDATA/uurhngf/uurhngfbrow.exe
Resource
win10v2004-20241007-en
General
-
Target
$APPDATA/uurhngf/htfrahrd.exe
-
Size
1.0MB
-
MD5
ae9a93b6d3836bd84f04a66b610ca7a6
-
SHA1
c4c11392fd9e64aa530f09f2a32cdc79cce23bdf
-
SHA256
1f57d73fb4f1bd20833b41140a51f5ba2fbed51c96c61087192d670f656aeef3
-
SHA512
a91dd24e5b1af6f0db5c0dcc0a950798a4a94452874fa822ee25ca6a4d4e0b7776a36e5929cbc6d7e95666190ba5291feccfe614570de72732bb92ab7ac50f4a
-
SSDEEP
12288:doID4HgLRaH+liJ0vV3Rdpzf62lZbv+BeXluc6Xqz0+3r269ttejc2aEm9dtTgi:qs0H5UV3Dpzx1UuDeY2EztTg
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htfrahrd.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2352 htfrahrd.exe 2352 htfrahrd.exe 2352 htfrahrd.exe 2352 htfrahrd.exe