5d4bc8366a0eb6d15b160ebfedeb9a5694ecf6c241ee4b176bba8ac96e105801

Analysis

max time kernel
149s
max time network
137s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

trickbot_00730000.exe
Size

132KB
MD5

741bb6f5389ed168168afaed7298d8d7
SHA1

6942c1d92c7b724daf1762efb9f7b197def3229b
SHA256

637592b1b3f10a5916eb1d6dd43b970da5cc7f2ad132e24cafdd1dbbfc89cdb9
SHA512

58258d3ef56fa11a06dcaa54347ee1223debb2691c64f33a9d77a76cf3048cb04fa79e94fc822a3b904299474efdadca6536ab3c7fccb7979d5c3c6de7ba28dd
SSDEEP

3072:6oDNbB2YhtT0ZUcuM2zRHQE+m5U1Kbu8Q9/2OWNcH/:JDNbBxwUW2zRwE+11Kbu8Q9/2Lmf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trickbot_00730000.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	trickbot_00730000.exe

C:\Users\Admin\AppData\Local\Temp\trickbot_00730000.exe
"C:\Users\Admin\AppData\Local\Temp\trickbot_00730000.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download