Analysis
-
max time kernel
79s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 01:45
Behavioral task
behavioral1
Sample
c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe
Resource
win10v2004-20241007-en
General
-
Target
c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe
-
Size
172KB
-
MD5
92dd80ddc1c4b689e05423f022deea78
-
SHA1
6f5f29fb5f2f4803d145cada4e2ce89ceef04864
-
SHA256
c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb
-
SHA512
e2364ba140f7f5777c7b36702a087b47e7e94d67f6dc8e9bef036ec9f0087b3984bccfae99b0cae38065c28ec99fbaa67f5380d5a626f43281704f63601579fe
-
SSDEEP
3072:UVqoCl/YgjxEufVU0TbTyDDalR5n93273/+yJKy:UsLqdufVUNDa9932ag
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe 1400 c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe"C:\Users\Admin\AppData\Local\Temp\c2fa97de6ba30332f59996d689c7bac9d6e9feb4cc988e5b081edb3fa1da21bb.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1400