Analysis

  • max time kernel
    642s
  • max time network
    653s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 22:18

Errors

Reason
Machine shutdown

General

  • Target

    The-MALWARE-Repo-master/Trojan/Sevgi.a.exe

  • Size

    203KB

  • MD5

    b28505a8050446af4638319060e006e9

  • SHA1

    d3ddca0f06af4df29a9f9fadb6bad8504add5525

  • SHA256

    750e37d1fdd64e9ea015272a0db6720ac9a8d803dc0caad29d0653756a8e5b17

  • SHA512

    889dc35054f5adc5b5445fc90dae5e19fe95ee04432f5230994124b73f9a1fc4bb050aac789f4934c84ed42d8c063b8219563e33a48b92f10294b7d8e426b9f9

  • SSDEEP

    3072:M7PDcEPPhtIlT5ri9bOqStDvzvSheG3ivbV0EIU9j4szgGGl/2tdnpm7no3:qPDcEPZSTrsyLzSovp0PGUGkQnY7o3

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Sevgi.a.exe
    "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Sevgi.a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    PID:1488
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:1460
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:448

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/448-67-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

        Filesize

        4KB

      • memory/1460-63-0x0000000002E60000-0x0000000002E61000-memory.dmp

        Filesize

        4KB

      • memory/1488-0-0x0000000000220000-0x0000000000221000-memory.dmp

        Filesize

        4KB

      • memory/1488-1-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-2-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-3-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-4-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-5-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-6-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-7-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-8-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-9-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-10-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-11-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-12-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-13-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-14-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-15-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-16-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-17-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-18-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-19-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-20-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-21-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-22-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-23-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-24-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-25-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-26-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-27-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-28-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-29-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-30-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-31-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-32-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-33-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-34-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-35-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-36-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-37-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-38-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-39-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-40-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-41-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-42-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-43-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-44-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-45-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-46-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-47-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-48-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-49-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-50-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-51-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-52-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-53-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-54-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-55-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-56-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-57-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-58-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-59-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-60-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-61-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-62-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-64-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      • memory/1488-65-0x0000000000400000-0x000000000046D000-memory.dmp

        Filesize

        436KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.