Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2024 17:13

General

  • Target

    f587b07402eeffdface43b9298302e339f5e58c5c548bd43bb8523356229a5a6.exe

  • Size

    2.4MB

  • MD5

    215c6060f9adfba0cb6b5d624dfe7bab

  • SHA1

    ad306b20750d8a4a710f99425da947685d3b1cdf

  • SHA256

    f587b07402eeffdface43b9298302e339f5e58c5c548bd43bb8523356229a5a6

  • SHA512

    a90e9fe28d45d37a3a05e6e2f4d2d8b7c478528f39d74efcf8ab2325f70cff2409e557d56dc3578d5d139efbd0235a26602097358a6af10fe64e13b393e47e21

  • SSDEEP

    49152:y/irYhITtmZrbQhrHqxZrbQhrHqFqUYwRxP/llAizXMLJ89z:yatmZrbQhrHqxZrbQhrHqFqU/nNlNzXP

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f587b07402eeffdface43b9298302e339f5e58c5c548bd43bb8523356229a5a6.exe
    "C:\Users\Admin\AppData\Local\Temp\f587b07402eeffdface43b9298302e339f5e58c5c548bd43bb8523356229a5a6.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2580-62-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-66-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2580-18-0x000000007463E000-0x000000007463F000-memory.dmp

    Filesize

    4KB

  • memory/2580-16-0x00000000000D0000-0x000000000016A000-memory.dmp

    Filesize

    616KB

  • memory/2580-58-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-60-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-1848-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2580-1847-0x000000007463E000-0x000000007463F000-memory.dmp

    Filesize

    4KB

  • memory/2580-1846-0x0000000000F10000-0x0000000000F64000-memory.dmp

    Filesize

    336KB

  • memory/2580-1844-0x0000000000A90000-0x0000000000ADC000-memory.dmp

    Filesize

    304KB

  • memory/2580-14-0x00000000000D0000-0x000000000016A000-memory.dmp

    Filesize

    616KB

  • memory/2580-10-0x00000000000D0000-0x000000000016A000-memory.dmp

    Filesize

    616KB

  • memory/2580-1843-0x0000000000B40000-0x0000000000B96000-memory.dmp

    Filesize

    344KB

  • memory/2580-19-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2580-20-0x0000000000BE0000-0x0000000000CA6000-memory.dmp

    Filesize

    792KB

  • memory/2580-21-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-34-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-8-0x00000000000D0000-0x000000000016A000-memory.dmp

    Filesize

    616KB

  • memory/2580-28-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-22-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-70-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-68-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-64-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-48-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-24-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-26-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-56-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-54-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-52-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-50-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-46-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-44-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-42-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-40-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-38-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-36-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-32-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2580-30-0x0000000000BE0000-0x0000000000CA0000-memory.dmp

    Filesize

    768KB

  • memory/2696-17-0x0000000000400000-0x0000000000672000-memory.dmp

    Filesize

    2.4MB

  • memory/2696-1851-0x0000000000416000-0x000000000042F000-memory.dmp

    Filesize

    100KB

  • memory/2696-0-0x0000000000400000-0x0000000000672000-memory.dmp

    Filesize

    2.4MB

  • memory/2696-11-0x0000000000400000-0x0000000000672000-memory.dmp

    Filesize

    2.4MB

  • memory/2696-7-0x0000000000400000-0x0000000000672000-memory.dmp

    Filesize

    2.4MB

  • memory/2696-1845-0x0000000000416000-0x000000000042F000-memory.dmp

    Filesize

    100KB

  • memory/2696-4-0x0000000000400000-0x0000000000672000-memory.dmp

    Filesize

    2.4MB

  • memory/2696-3-0x0000000000400000-0x0000000000672000-memory.dmp

    Filesize

    2.4MB

  • memory/2696-6-0x0000000000400000-0x0000000000672000-memory.dmp

    Filesize

    2.4MB

  • memory/2696-1850-0x0000000000416000-0x000000000042F000-memory.dmp

    Filesize

    100KB

  • memory/2696-1-0x0000000000416000-0x000000000042F000-memory.dmp

    Filesize

    100KB

  • memory/2696-1852-0x0000000000400000-0x0000000000672000-memory.dmp

    Filesize

    2.4MB