Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22-11-2024 21:28
General
-
Target
383e501270d7dee3cf9612e19ae12460efeb95c6144d1c376358ae04e2956386.exe
-
Size
2.8MB
-
MD5
2c15f54532b3fa104eb490c2e9aa4e72
-
SHA1
50a1f275ee91660bfec732df09c08af39e7f569c
-
SHA256
383e501270d7dee3cf9612e19ae12460efeb95c6144d1c376358ae04e2956386
-
SHA512
ddf26b939770b67f8d4834cb501b2f13de44dc07000191f4d86a34eac672d4d3b50d5e48c44aa0babd3c74d5acf9568aedb454e9c36dad5cdffd17f2a08bd89d
-
SSDEEP
24576:F0OzSBxBwtCcHXiFffGgtTzdNbExFM53eHviU4MtRO0ys9WCtK0jX/:F5EQHmfGybEx3jX/
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\383e501270d7dee3cf9612e19ae12460efeb95c6144d1c376358ae04e2956386.exe"C:\Users\Admin\AppData\Local\Temp\383e501270d7dee3cf9612e19ae12460efeb95c6144d1c376358ae04e2956386.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken