Analysis
-
max time kernel
32s -
max time network
34s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
27-12-2024 11:11
General
-
Target
SamFlash.exe
-
Size
40.1MB
-
MD5
f12dbf95da6430daca5896cbf5f4d26d
-
SHA1
42ff929901a144495657f6103796292318173555
-
SHA256
66af486c43f75e1bb7951457dbb173b56bb48a03179cf2ea05820981737494f3
-
SHA512
020e310a2148ad206b44ddc6cf89d2b6a38d8da31a63bac403d9aa00ea388e4e2354d4e0b586dadace7031a11ab5f0b54a09e54c5cb26512b5765bed3bdd5ef6
-
SSDEEP
786432:WJgcU5/BFm0ErjlqaxBKiZhOmXtSM8OLaZr6B+M5rvPWdv4BNT:1c8BFmxjlq4KeV216BZxPk
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SamFlash.exe"C:\Users\Admin\AppData\Local\Temp\SamFlash.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD576fbe77cbc68f3bd5f0decad25775716
SHA12ebc2dea0b2224ea73fb5413d94ad38218122bf3
SHA2568d59129db45c9f234318144380c9d167d89a9faa8e2a6aede9b5a3bcfdf650b6
SHA5121a5d850914bd033defe42de3a333c2a7497927a07289258acd5ec08e973b4ed45030b0f299d6da5bac16ad607ed471b3db52a5c9676a532ecaa0836682618230
-
Filesize
199B
MD572f84c992a3045205db7e219fdf9e659
SHA161c2cfe006c9a077ee338c722e4c1cad1f336c6b
SHA256596fd8bab743b07443cc338793fa3342208039fb5a115ecd013685019afb3f2a
SHA512d8b01015abbcdedebb9a5c467e0a02cb5987574344b9d52f46a66b1d4f5346f5ab378a7dbc3a682b128059cf44c4bdbe8941f82e8f6fe0d14774c0072d966613
-
Filesize
4.5MB
-
Filesize
38.4MB
-
Filesize
128KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
19.5MB
-
Filesize
5.1MB
-
Filesize
928KB
-
Filesize
608KB
-
Filesize
7.8MB
-
Filesize
3.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
2.1MB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
680KB
-
Filesize
712KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
40.1MB
-
Filesize
408KB
-
Filesize
4KB