Analysis
-
max time kernel
1563s -
max time network
1565s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 02:21
General
-
Target
360390_crypt.exe
-
Size
2KB
-
MD5
955fc65f54fa12afaa5199585d749e67
-
SHA1
b4b401f7ce39cdc1444c7505206f22e2d8177336
-
SHA256
286f57eb83302eaee7fda4836e4197136f7f9de0b6e4ff3df7649e3bf2f82389
-
SHA512
d9b35e6e92af712586424228986b9a45dea5ac1b7e54bcaecc6b24d558589d4fb1976c66f11de591be2855b0900bfb0b111bad3b0c1e81f62387f1d3f725245a
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\360390_crypt.exe"C:\Users\Admin\AppData\Local\Temp\360390_crypt.exe"1⤵
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\FormatGroup.docx"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1bc1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD56671b240274eeae164a18dc605900c8b
SHA1a4e65fb89557c911aea00b53651c106931243aa9
SHA256c9364cf929e58ec7b4ef54e1070a221d26f85e92a243caf63fc27da02f52f5f2
SHA512363428d701fc90f895f2c8eee192fc97723605d943efd29b307449f0f9d4f25a56bb658d611c21a9ab3d390a0bf36aa2eb25f6b27216d862c6ab037874883288
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB