Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-01-2025 03:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
aaaaaaaaaaaaaaaaaa.exe
Resource
win7-20240903-en
4 signatures
150 seconds
General
-
Target
aaaaaaaaaaaaaaaaaa.exe
-
Size
848KB
-
MD5
d4dea766d9cd1fdb9545c08969811132
-
SHA1
c02a941d7ab478095ce042262d5cac4be864f9ed
-
SHA256
17dc6ae2b8a4a5e958a09b19a771e102ec2ebbad438da6123705344eedcadf68
-
SHA512
708c12cf2110e604fedbfb7c5584edadcfd9ff29a161cd48dff0232921cdccf099c9eab8d59c66f45865d59c1759f6adb187747d4b743cb33bde4dcbf5e39ac6
-
SSDEEP
12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLEZFoyB1wCdQzdMgqLjSWx:ffmMv6Ckr7Mny5QLqBUCdvXx
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaaaaaaaaaaaaaaaaa.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2412 aaaaaaaaaaaaaaaaaa.exe 2412 aaaaaaaaaaaaaaaaaa.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2412 aaaaaaaaaaaaaaaaaa.exe 2412 aaaaaaaaaaaaaaaaaa.exe