Overview
overview
10Static
static
3abf3620108...17.exe
windows7-x64
10abf3620108...17.exe
windows10-2004-x64
10$APPDATA/u...rd.exe
windows7-x64
3$APPDATA/u...rd.exe
windows10-2004-x64
3$APPDATA/u...gf.exe
windows7-x64
3$APPDATA/u...gf.exe
windows10-2004-x64
3$APPDATA/u...ow.exe
windows7-x64
3$APPDATA/u...ow.exe
windows10-2004-x64
3Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
abf36201080f1e36f9f91aa8418aa5a4c23a777c82075baa171b9f2d7d963017.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
abf36201080f1e36f9f91aa8418aa5a4c23a777c82075baa171b9f2d7d963017.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$APPDATA/uurhngf/htfrahrd.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$APPDATA/uurhngf/htfrahrd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$APPDATA/uurhngf/uurhngf.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$APPDATA/uurhngf/uurhngf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$APPDATA/uurhngf/uurhngfbrow.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$APPDATA/uurhngf/uurhngfbrow.exe
Resource
win10v2004-20241007-en
General
-
Target
$APPDATA/uurhngf/uurhngf.exe
-
Size
992KB
-
MD5
e2dfb1c849054d92814d943152945de5
-
SHA1
1609d7775aacff4a7694c2d6fc2524e3f174d946
-
SHA256
6ff7f0b69c1ab65d162b586bae7a64bb140a9e62bbb005c1aa9082fa20249e9a
-
SHA512
801f41b47941287f934394be7a38615e889bd8d6a0071b4ae3cae030b9f57bda6b462e74076f25dd63d6b22bfbeb2e8da1146a01504f25c98b62608fc456d535
-
SSDEEP
12288:NwPbj3oBLXPJ0A44/DSXJ5TC1Oc76UsyDyvrFmNMT3BgEP:NwXYBLfamu59C1ONmykeT3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uurhngf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2868 uurhngf.exe 2868 uurhngf.exe