458915aa05d50d093ac7d2df5b47c9141f91da065edc2f8022f9ba107ec405be

Analysis

max time kernel
94s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

喜欢此软件_love it.exe
Size

66KB
MD5

d4d4be4bd56ed03eca031be8b8a9814c
SHA1

06d4aef8a831a883c5574d4b46c29df4b81992bf
SHA256

c90d9af17233a717fdb8b08d45749680efeca7046deef950ff1d4e987be68681
SHA512

75d5a6df561b4bbd497a45bb7feb4f11dce2b28eff93ec8ffe5cae0cdde0857f5346aa498bd908307f81c1f15cac088cdc1ba96434ef4a2d135bcf45063f96cf
SSDEEP

1536:JdBoWdHaDL1UOUc01anifKUYJFqLa4qpqR:JgWdHaDhocDGKU4t4qpqR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	喜欢此软件_love it.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 5024	4752	喜欢此软件_love it.exe	82
PID 4752 wrote to memory of 5024	4752	喜欢此软件_love it.exe	82
PID 4752 wrote to memory of 5024	4752	喜欢此软件_love it.exe	82

C:\Users\Admin\AppData\Local\Temp\喜欢此软件_love it.exe
"C:\Users\Admin\AppData\Local\Temp\喜欢此软件_love it.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt33241.bat "C:\Users\Admin\AppData\Local\Temp\?????_love it.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bt33241.bat

Filesize
225B

MD5
8b199a7b5885fc7be127f0fdba39140e

SHA1
0b3015371825ed1d02ceb79c7f5a4ee719ebe7a3

SHA256
7f9ffd0b55164fb619f9fc314726047df7620a7368b95fa7cc460ad3c0be135f

SHA512
430f2d098de2182aa4e592aa9d07e1c414468c4cfd9bac6ebc181596ff9f7a8a5f364e51428d8bab043d40633a804e12f880afbdbece7cb5779ed3f493fe924f

Download Submit
memory/4752-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download