2b43e1b7592186c6bc8ff0d42f58c69ee00171c65dfac6c8e59a285e41579397

Analysis

max time kernel
149s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 22:05

Target

scjFAgqMDG.exe
Size

744.3MB
MD5

f37c25e374b8a479dd4895182353f32a
SHA1

c271ffe064c0517a4de1514202a72392e775a440
SHA256

2b43e1b7592186c6bc8ff0d42f58c69ee00171c65dfac6c8e59a285e41579397
SHA512

d943a228277f06279d0c4b2ea73a39df827f5c0d5d597d9eeee030b56e815613ae01e74c2aebef696c0f19e2837d74f48ae10ce35ad9a03ee425f1b5ab0a766f
SSDEEP

12582912:2GaF/uzldJ5T5sZ6cRSFOAUHEJPOSyoWKlrdxDdviMCic7fw+YH2YXABdPw+BF1P:SIzrJ5TwjRXExOSNz7xDMFo+7YXABdPR

Score

7^/10

discovery

Executes dropped EXE 1 IoCs

pid	Process
1924	scjFAgqMDG.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scjFAgqMDG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scjFAgqMDG.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4856	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1252	4556	scjFAgqMDG.exe	89
PID 4556 wrote to memory of 1252	4556	scjFAgqMDG.exe	89
PID 4556 wrote to memory of 1252	4556	scjFAgqMDG.exe	89
PID 1252 wrote to memory of 4856	1252	cmd.exe	91
PID 1252 wrote to memory of 4856	1252	cmd.exe	91
PID 1252 wrote to memory of 4856	1252	cmd.exe	91