78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe
Size

1.2MB
MD5

65a28cddb97884a94a7c9faef74300c3
SHA1

8cdb55cfbf3b463246bfea5ef3b8e3de34c64149
SHA256

78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf
SHA512

6085a372018483ccdb19b825c1f9bd378d5cfbd0de6312f64bd1746ddd186a392330721d25746cce1ed26ab1c746f50db5fd5b81584644978312936070ecd2b4
SSDEEP

24576:Ttb20pkaCqT5TBWgNQ7aHkf45YUptDT0n5pe86A:QVg5tQ7aHkfdUbW5pf5

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 1236	2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe	28

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1236	svchost.exe
1236	svchost.exe
1236	svchost.exe
1236	svchost.exe
1236	svchost.exe
1236	svchost.exe
1236	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe
2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe
2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1236	2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe	28
PID 2972 wrote to memory of 1236	2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe	28
PID 2972 wrote to memory of 1236	2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe	28
PID 2972 wrote to memory of 1236	2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe	28
PID 2972 wrote to memory of 1236	2972	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe	28

C:\Users\Admin\AppData\Local\Temp\78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe
"C:\Users\Admin\AppData\Local\Temp\78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurtling

Filesize
281KB

MD5
292e198398b4804ed9b1225a460b6e95

SHA1
ef119638f6151a1a4b7b0a6df96817c8ccd2647b

SHA256
068b8518b839676c57ba3cc4d14c41bba20bed264781472aa4ae7922a0b67957

SHA512
2da2c70c5ff4060fb4034ade83f8167f4ec51c24d80ccef9e42c250bb1f510c5758d51e6c6145252610491933903e0881ff49b75e42bc09a70a3f9e4b8bb43b0

Download Submit
memory/1236-8-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1236-9-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1236-10-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download
memory/1236-11-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1236-12-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2972-7-0x0000000000C30000-0x0000000001030000-memory.dmp

Filesize
4.0MB

Download