Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-01-2025 03:50

General

  • Target

    aaaaaaaaaaaaaaaaaa.exe

  • Size

    848KB

  • MD5

    d4dea766d9cd1fdb9545c08969811132

  • SHA1

    c02a941d7ab478095ce042262d5cac4be864f9ed

  • SHA256

    17dc6ae2b8a4a5e958a09b19a771e102ec2ebbad438da6123705344eedcadf68

  • SHA512

    708c12cf2110e604fedbfb7c5584edadcfd9ff29a161cd48dff0232921cdccf099c9eab8d59c66f45865d59c1759f6adb187747d4b743cb33bde4dcbf5e39ac6

  • SSDEEP

    12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLEZFoyB1wCdQzdMgqLjSWx:ffmMv6Ckr7Mny5QLqBUCdvXx

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaaaaaaaaaaaaaaaaa.exe
    "C:\Users\Admin\AppData\Local\Temp\aaaaaaaaaaaaaaaaaa.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2412-5-0x00000000001C0000-0x00000000001C4000-memory.dmp

    Filesize

    16KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.