9e4ce12e22cb5f214591dd3c369f9eb114f21f956e3a5d099483935d426a4ac1

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Readm.md/wow64/YandexDisk3ShellExt-1511.dll
Size

950KB
MD5

62985a9dd149cbe7d518cdefd6abed78
SHA1

4724c802e7a1c82bc1932f6acdc9057188d268a5
SHA256

4637c2a9554bc0289a4789a538b09221a216ef74644bcd05a50bc334d17cf306
SHA512

434af6b17c7bc615d5b195000996f09d0482720974c03926bb48c6fbe200a73f97ddad17fedbcff3ba1232439662aa65046c9c1158b15bb2faeab2e24e685864
SSDEEP

12288:oxIDiqMK2jSR6327g6uh7/jUvUc/8iElCf/FQ7jp9nJAY4Q/0UtdOXat+j+uq11/:eIajqf/FQ7jWQ/zt+jI11

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1312	2408	regsvr32.exe	30
PID 2408 wrote to memory of 1312	2408	regsvr32.exe	30
PID 2408 wrote to memory of 1312	2408	regsvr32.exe	30
PID 2408 wrote to memory of 1312	2408	regsvr32.exe	30
PID 2408 wrote to memory of 1312	2408	regsvr32.exe	30
PID 2408 wrote to memory of 1312	2408	regsvr32.exe	30
PID 2408 wrote to memory of 1312	2408	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Readm.md\wow64\YandexDisk3ShellExt-1511.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Readm.md\wow64\YandexDisk3ShellExt-1511.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads