Analysis
-
max time kernel
900s -
max time network
409s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2025, 21:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Tiny v0.2/Tiny.exe
Resource
win7-20240903-en
windows7-x64
25 signatures
900 seconds
Behavioral task
behavioral2
Sample
Tiny v0.2/Tiny.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
900 seconds
General
-
Target
Tiny v0.2/Tiny.exe
-
Size
618KB
-
MD5
b9f7f125066c414f71fb9b805879a4cf
-
SHA1
e7a5ea344304f289029d031b012a680b689aa7d1
-
SHA256
d944181cf3c1dc7b02d30d4802d491a99f42a181446ce1be7710724541210c7d
-
SHA512
4bd845189e56aaa0ff55a321372ff7b3ab6cf68a272787371c014f70831eca56d6b03365a4f8589b1f3b55a083c8d908e9cb9f6167ac868113354d9ca436433f
-
SSDEEP
12288:ILEddxz9C1r0twaY0lmJZdwA8mRARNC+y9ErlfSu:KE/XFA4pAARNCvulfSu
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tiny.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe 1048 Tiny.exe