72fb0d0a7b5d1db1e4a08668c7599ab47d8667765f0d7152bace890af725445d

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72FB0D0A7B5D1DB1E4A08668C7599AB47D8667765F0D7152BACE890AF725445D.exe
Size

1.0MB
MD5

31de769f543026827f7f0ae67ecd1607
SHA1

97ce538bf5fcfbf6296f2f4e3cd308f7b64bb8fe
SHA256

72fb0d0a7b5d1db1e4a08668c7599ab47d8667765f0d7152bace890af725445d
SHA512

3351f9a948244e18b6d5454eb7099027a803338fd67abff522594143d2b4c1a2defc4bf7b42943c7d434dade06a541488acfb22647184b9edcd0670c8ec7c1b6
SSDEEP

24576:m4lavt0LkLL9IMixoEgealHZksrOjFw3tlzGEIkq9MmCS:xkwkn9IMHealHOsrOjatl/aPCS

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72FB0D0A7B5D1DB1E4A08668C7599AB47D8667765F0D7152BACE890AF725445D.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3040	72FB0D0A7B5D1DB1E4A08668C7599AB47D8667765F0D7152BACE890AF725445D.exe
3040	72FB0D0A7B5D1DB1E4A08668C7599AB47D8667765F0D7152BACE890AF725445D.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3040	72FB0D0A7B5D1DB1E4A08668C7599AB47D8667765F0D7152BACE890AF725445D.exe
3040	72FB0D0A7B5D1DB1E4A08668C7599AB47D8667765F0D7152BACE890AF725445D.exe

C:\Users\Admin\AppData\Local\Temp\72FB0D0A7B5D1DB1E4A08668C7599AB47D8667765F0D7152BACE890AF725445D.exe
"C:\Users\Admin\AppData\Local\Temp\72FB0D0A7B5D1DB1E4A08668C7599AB47D8667765F0D7152BACE890AF725445D.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-5-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download