2b43e1b7592186c6bc8ff0d42f58c69ee00171c65dfac6c8e59a285e41579397

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/12/2024, 22:05

Target

scjFAgqMDG.exe
Size

744.3MB
MD5

f37c25e374b8a479dd4895182353f32a
SHA1

c271ffe064c0517a4de1514202a72392e775a440
SHA256

2b43e1b7592186c6bc8ff0d42f58c69ee00171c65dfac6c8e59a285e41579397
SHA512

d943a228277f06279d0c4b2ea73a39df827f5c0d5d597d9eeee030b56e815613ae01e74c2aebef696c0f19e2837d74f48ae10ce35ad9a03ee425f1b5ab0a766f
SSDEEP

12582912:2GaF/uzldJ5T5sZ6cRSFOAUHEJPOSyoWKlrdxDdviMCic7fw+YH2YXABdPw+BF1P:SIzrJ5TwjRXExOSNz7xDMFo+7YXABdPR

Score

7^/10

discovery

Executes dropped EXE 1 IoCs

pid	Process
2736	scjFAgqMDG.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scjFAgqMDG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scjFAgqMDG.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2920	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2364	2308	scjFAgqMDG.exe	31
PID 2308 wrote to memory of 2364	2308	scjFAgqMDG.exe	31
PID 2308 wrote to memory of 2364	2308	scjFAgqMDG.exe	31
PID 2308 wrote to memory of 2364	2308	scjFAgqMDG.exe	31
PID 2364 wrote to memory of 2920	2364	cmd.exe	33
PID 2364 wrote to memory of 2920	2364	cmd.exe	33
PID 2364 wrote to memory of 2920	2364	cmd.exe	33
PID 2364 wrote to memory of 2920	2364	cmd.exe	33
PID 2820 wrote to memory of 2736	2820	taskeng.exe	35
PID 2820 wrote to memory of 2736	2820	taskeng.exe	35
PID 2820 wrote to memory of 2736	2820	taskeng.exe	35
PID 2820 wrote to memory of 2736	2820	taskeng.exe	35

C:\Windows\system32\taskeng.exe
taskeng.exe {CC9B396A-5F63-4EDA-A0BE-36DA550ABB53} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Roaming\dvrtfBxXgG\scjFAgqMDG.exe
  C:\Users\Admin\AppData\Roaming\dvrtfBxXgG\scjFAgqMDG.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2736