1af039b45840346b46a0552781a6fcc4e53262ceb0297e743a331d37ae402434

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7zS8B74BEBB/623f4ec77fd3f_Sat1772aefb.exe
Size

151KB
MD5

b577af6c9338bcbe487d0fe020a3c2f6
SHA1

8d64719d7e8f9b99a1dc6e72a604d29ee8539f49
SHA256

5845fc002f43c7fb90f2809c5b8af71c2edef9ccb0e244966ce765868aaaf7d8
SHA512

b1a48a457c0a4bc9d5e0e5dc68676941d1ecb1e356a7be8100dc1945e146372d300254baa30ec7306cfa1f36dae8f9a467716909a43330b8809562a254d7296c
SSDEEP

1536:1k/QfYmlz//qf/631jmIeP/hbNk64iH/k/bFA:1k/42yFahbuFW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	623f4ec77fd3f_Sat1772aefb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2536	623f4ec77fd3f_Sat1772aefb.exe

C:\Users\Admin\AppData\Local\Temp\7zS8B74BEBB\623f4ec77fd3f_Sat1772aefb.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8B74BEBB\623f4ec77fd3f_Sat1772aefb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-0-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Filesize
4KB

Download
memory/2536-1-0x00000000008B0000-0x00000000008DE000-memory.dmp

Filesize
184KB

Download
memory/2536-2-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2536-3-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download
memory/2536-4-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Filesize
4KB

Download
memory/2536-5-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download
memory/2536-6-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download