c96b41fac848211321861fcf957e5f475a950c56f9024f792e5c9584f1fbd3ef

Analysis

max time kernel
300s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

microsoft-cleaned.exe
Size

337KB
MD5

2568651635cffe50fd45776886cdc514
SHA1

bf7567d7492b701a4471a8c9b7a401460bf4621c
SHA256

03f1e07d8b2eddac94f0de473100dd8f33183c0030dd275a9dfb467d99af97b7
SHA512

53e0046576c21da95ca5766e7f06fba20f77310a2e486bb1b7c6207a7345b039a846ffa6141f6c4b2f2cf76315bd052dcfe04e016f476fefad62786a2d286f5b
SSDEEP

6144:C+uRqxZQFpFXvGp4F3qd75zSCIHpj3el71nVNi9IY2enhzSs75/Krbgx02r:C+08+FXt3qPOCIH8l7ZHyIXepSoab

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

microsoft-cleaned.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft-cleaned.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft-cleaned.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

microsoft-cleaned.exe

pid	process
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe
2696	microsoft-cleaned.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

microsoft-cleaned.exe

description pid process

Token: SeDebugPrivilege 2696 microsoft-cleaned.exe

description	pid	process
Token: SeDebugPrivilege	2696	microsoft-cleaned.exe

C:\Users\Admin\AppData\Local\Temp\microsoft-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\microsoft-cleaned.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2696-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

Filesize
4KB

Download
memory/2696-1-0x00000000002C0000-0x000000000031A000-memory.dmp

Filesize
360KB

Download
memory/2696-2-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-3-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

Filesize
4KB

Download
memory/2696-4-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-5-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-6-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-7-0x0000000004BE0000-0x0000000004C00000-memory.dmp

Filesize
128KB

Download
memory/2696-8-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-9-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download