9994b9e197b422529221de7238dc0e44ae21e66d78c48355f31837c3696ec90e

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe
Size

389KB
MD5

47311da785a73a1d499f17e6e2e3f787
SHA1

5bd74b1ea8a47b3c19b84030e131ccae444f1672
SHA256

89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6
SHA512

dec6848db46c1055d740377b02bb835d8adf35a0552ec776ce3fce967cf7b459ca327945b7561543a63600c80cb842098f7365e7773495e4aff08a4bf7775c49
SSDEEP

6144:DE+yclwQKjdn+WPtYVJIoBfT12EJdz1ByZ/kLY:DBdlwHRn+WlYV+ycCVzM/kLY

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\VMware	89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe
File opened for modification	C:\Program Files (x86)\VMware\VMware Workstation	89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe
File opened for modification	C:\Program Files (x86)\VMware\VMware Workstation\x64	89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe
File created	C:\Program Files (x86)\VMware\VMware Workstation\x64\__tmp_rar_sfx_access_check_259425559	89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe
File created	C:\Program Files (x86)\VMware\VMware Workstation\x64\regkey.dat	89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe
File opened for modification	C:\Program Files (x86)\VMware\VMware Workstation\x64\regkey.dat	89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe

C:\Users\Admin\AppData\Local\Temp\89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe
"C:\Users\Admin\AppData\Local\Temp\89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads