30a99f0c9acd05ac7a54c1a617aa95c5a28da095e4dfc511da0dc1512222f9a8

Analysis

max time kernel
442s
max time network
444s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21/11/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fisch Macro IRUS.exe
Size

381KB
MD5

a16d1affbbc71808d1123b120a84dbd9
SHA1

01b6c9e2d561d8be0098ddef06f57652f5006483
SHA256

30a99f0c9acd05ac7a54c1a617aa95c5a28da095e4dfc511da0dc1512222f9a8
SHA512

26f60227c53204e1ab74f253e50d0bdf6a8aadbd3f7ae457718f8239e79e78462de4cefa19af427ccdc826c8b3e8fdfb563b088619c08f169dba391990f93854
SSDEEP

6144:tgq9BXg2Gkza5+XMFxScM6KtLvlQPq2vip+Pw4n8olM3jmNmLxTm:t9BXTGr5+8FvKtzlBiPoNTmNH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fisch Macro IRUS.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4868	Fisch Macro IRUS.exe
4868	Fisch Macro IRUS.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4868	Fisch Macro IRUS.exe
4868	Fisch Macro IRUS.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4868	Fisch Macro IRUS.exe

C:\Users\Admin\AppData\Local\Temp\Fisch Macro IRUS.exe
"C:\Users\Admin\AppData\Local\Temp\Fisch Macro IRUS.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4868-0-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/4868-1-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/4868-2-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/4868-3-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download