de6b367a4b3a81fea07cdaa9406b9b70a994581cfae539f5da441268e4be4188

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ 9-XTC-204-60THD.xlsx.exe
Size

143KB
MD5

c9951fb84a416c1f329b39b2da482348
SHA1

e250949b96260df94f7c4cce9ef009069690ffe6
SHA256

de6b367a4b3a81fea07cdaa9406b9b70a994581cfae539f5da441268e4be4188
SHA512

1e450fc3fff15facd76ce9ac643e2e0ef2ffad6e18ba54dd70f93968fc984d14f81f8429409ddf25320a2d80df6e240367b2dd49e4793acad2460c158e62c556
SSDEEP

3072:IODxM5DNveAHHY+axlCTo0JLsLbJo9LdtxAuAqdES0m5kJ8QvT5+hM94K2icI7y:IO9M5DNveAHHY+clCU0JLsLb+9LdtxAN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

RFQ 9-XTC-204-60THD.xlsx.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ 9-XTC-204-60THD.xlsx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RFQ 9-XTC-204-60THD.xlsx.exe

description	pid	Process
Token: SeDebugPrivilege	1748	RFQ 9-XTC-204-60THD.xlsx.exe

C:\Users\Admin\AppData\Local\Temp\RFQ 9-XTC-204-60THD.xlsx.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 9-XTC-204-60THD.xlsx.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-0-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

Filesize
4KB

Download
memory/1748-1-0x0000000000A30000-0x0000000000A5A000-memory.dmp

Filesize
168KB

Download
memory/1748-2-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/1748-3-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

Filesize
4KB

Download
memory/1748-4-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download