Analysis
-
max time kernel
718s -
max time network
727s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22-11-2024 02:36
General
-
Target
5600.exe
-
Size
424KB
-
MD5
b2e807bb5140744cd64174c2b811237e
-
SHA1
949fca8bab5c656fa950dd65cb896ecfdde68776
-
SHA256
9f617bee97b9c676dd5ed928093f64e020c6e93ea60b0f641fc3127a7a325ced
-
SHA512
a85c5809af9371f11426f67c463ff80e11ef0e307271716fccff5d57afe6f74261a453b2ee96f5b3526c54a2be02166fd29dfcd0160c9039b7b9e85cbcb66f5c
-
SSDEEP
6144:CEaPKs6jJIrlbAC+RUPI/PsI/Pr1HPsIpP:CEaPKs6jJIrlEC2SXUE
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5600.exe"C:\Users\Admin\AppData\Local\Temp\5600.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
440KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB