Analysis
-
max time kernel
1791s -
max time network
1164s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-11-2024 13:29
Static task
static1
Behavioral task
behavioral1
Sample
mtksecbypass_v12.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
mtksecbypass_v12.exe
Resource
win11-20241007-en
General
-
Target
mtksecbypass_v12.exe
-
Size
19.7MB
-
MD5
978ce2baacdc4a4d370d2cad1014641d
-
SHA1
524b43651a20a3a5da3f6c6bc7a12f2caa17feef
-
SHA256
6d0b760cfe0b66dfb3b535f9571183913389ad88719adaff630d9c04fd4f36fc
-
SHA512
ec7bc18eedd235e473469864c61a48a6cf59402235235fa37f96ecfd2f48b21cba0812183b3b70d4c615f80451a30247f0ee0cdc0c12ea559d0b7ad224aff790
-
SSDEEP
393216:vzmS2D1u1e3CL3rbg2cXXO5e3O/U4DW2rJJsv6tWKFdu9CJZdi:75I4Vbg2cu5D/U4DhrLZc
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
mtksecbypass_v12.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mtksecbypass_v12.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
mtksecbypass_v12.exepid Process 888 mtksecbypass_v12.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mtksecbypass_v12.exepid Process 888 mtksecbypass_v12.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mtksecbypass_v12.exepid Process 888 mtksecbypass_v12.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mtksecbypass_v12.exe"C:\Users\Admin\AppData\Local\Temp\mtksecbypass_v12.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:888