2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/01/2025, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe
Size 1.2MB
Sample250110-rhd2wawncs
SHA256 2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a
MD5 41445e9bd31d9f944416e4aef5564687
SHA1 dd6320984f7e72271bd789b9a54e2bfb7cebd4e8
SHA512 af34962313122e52a5d74abd15e5b4efd996ef0609c3302d02c6460ced9f4a99746bb638efaeb9f9cda9153437963d32dc60f5457ebf0602c72a942ead359a2d
SSDEEP 24576:4u6J33O0c+JY5UZ+XC0kGso6Fa4gDwFWdYSzQqQZx5yIpWY:yu0c++OCvkGs9Fa4tFWj0ZmY
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2664 set thread context of 2848	2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	2664	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2848	svchost.exe
2848	svchost.exe
2848	svchost.exe
2848	svchost.exe
2848	svchost.exe
2848	svchost.exe
2848	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe
2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe
2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2848	2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe	30
PID 2664 wrote to memory of 2848	2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe	30
PID 2664 wrote to memory of 2848	2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe	30
PID 2664 wrote to memory of 2848	2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe	30
PID 2664 wrote to memory of 2848	2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe	30
PID 2664 wrote to memory of 2680	2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe	31
PID 2664 wrote to memory of 2680	2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe	31
PID 2664 wrote to memory of 2680	2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe	31
PID 2664 wrote to memory of 2680	2664	2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe	31

C:\Users\Admin\AppData\Local\Temp\2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe
"C:\Users\Admin\AppData\Local\Temp\2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\2cccdbe33315ad0e455543f64273d67ee58a1c8aad0bdeadace50fa50078a61a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 312
  2⤵
  - Program crash
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deblateration

Path C:\Users\Admin\AppData\Local\Temp\deblateration
Size 282KB
SHA256 8c2f074fd06482c3cc6508e4f78b96389d249f982a7053202a3b6dfd5a1c30a1
MD5 8579ee81ca94443c8bd7a494cac10c72
SHA1 8036baa9c94cb32a8785bfd38f113c176342ef98
SHA512 73efba76fcdaf1ba907a8820b9035491e53c95696ccce9cb87498b2d12d37cb451fea16aee30d13c27ccada0ca0f75b02580bf55157ede6623e1dc94d55fafd7
SSDEEP 6144:Ghi9/Un9lB3P6SbiJqQMPN1SNwUtUWwHiw7u6qJ1sHK2N1olcCPE:GU/U13P5yzMPPjUKTiAqOb99
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2664-7-0x00000000008C0000-0x0000000000CC0000-memory.dmp

Download

memory/2848-8-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2848-9-0x0000000000910000-0x0000000000C13000-memory.dmp

Download

memory/2848-10-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2848-11-0x0000000000400000-0x0000000000447000-memory.dmp

Download