9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02

Resubmissions

15-12-2024 14:23

241215-rqaz7axjav 10

15-12-2024 03:54

241215-ef7vystje1 10

Analysis

max time kernel
9s
max time network
10s
platform
windows7_x64
resource
win7-20240903-de
resource tags

arch:x64arch:x86image:win7-20240903-delocale:de-deos:windows7-x64systemwindows
submitted
15-12-2024 14:23

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02.exe
Size

278KB
MD5

8c3ef2eba970f543f0ebe6dced908402
SHA1

431157eaf15244e5d8cc167511b4611f4dfae85c
SHA256

9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02
SHA512

fd0e2b2539ad4a0d587ba0059653d82e2bf4aadf37ca5a097b60fc0658aa1b3850bb589ee1cc0d5c39bfc574beaa4d56eea6a32f57407bfee21b2f306c737680
SSDEEP

3072:FUbtVKuFEC34/8yBV+VKuFJC34GtmANWJ/j3:FUb/KVKq8NKmKntZWJT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02.exe

C:\Users\Admin\AppData\Local\Temp\9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02.exe
"C:\Users\Admin\AppData\Local\Temp\9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2204

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-6-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/2204-5-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Filesize
4KB

Download
memory/3048-0-0x000000007470E000-0x000000007470F000-memory.dmp

Filesize
4KB

Download
memory/3048-1-0x0000000000A90000-0x0000000000AD8000-memory.dmp

Filesize
288KB

Download
memory/3048-2-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/3048-3-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/3048-4-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download