Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-02-2025 09:55
Behavioral task
behavioral1
Sample
p.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
p.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
p.exe
-
Size
3.7MB
-
MD5
ef49068784d28ce24e93fe5db5b89515
-
SHA1
efc2130707c28a88e47a6e30e72fe5178d68c9db
-
SHA256
ba25f8ebac2b55cc744c226010fa3c4422dd77d8aeee495d203715abe8553b27
-
SHA512
a142225e28bb757143cc62b83e2dfe860399d1093ca52876590d0e2d6c3b4c4a7099c00a5c400041b023ef4bfe768ed09ed5a0d88a5a28cafdb704d2fa9427c2
-
SSDEEP
49152:N8o8bZjyJVD0s9Mr3XIfRviWkgEOaxfCbCMcXGtSgvZPOQ5Qn:N8o8VOUs9joRbMc2tSW6n
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language p.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1636 wmic.exe Token: SeSecurityPrivilege 1636 wmic.exe Token: SeTakeOwnershipPrivilege 1636 wmic.exe Token: SeLoadDriverPrivilege 1636 wmic.exe Token: SeSystemProfilePrivilege 1636 wmic.exe Token: SeSystemtimePrivilege 1636 wmic.exe Token: SeProfSingleProcessPrivilege 1636 wmic.exe Token: SeIncBasePriorityPrivilege 1636 wmic.exe Token: SeCreatePagefilePrivilege 1636 wmic.exe Token: SeBackupPrivilege 1636 wmic.exe Token: SeRestorePrivilege 1636 wmic.exe Token: SeShutdownPrivilege 1636 wmic.exe Token: SeDebugPrivilege 1636 wmic.exe Token: SeSystemEnvironmentPrivilege 1636 wmic.exe Token: SeRemoteShutdownPrivilege 1636 wmic.exe Token: SeUndockPrivilege 1636 wmic.exe Token: SeManageVolumePrivilege 1636 wmic.exe Token: 33 1636 wmic.exe Token: 34 1636 wmic.exe Token: 35 1636 wmic.exe Token: SeIncreaseQuotaPrivilege 1636 wmic.exe Token: SeSecurityPrivilege 1636 wmic.exe Token: SeTakeOwnershipPrivilege 1636 wmic.exe Token: SeLoadDriverPrivilege 1636 wmic.exe Token: SeSystemProfilePrivilege 1636 wmic.exe Token: SeSystemtimePrivilege 1636 wmic.exe Token: SeProfSingleProcessPrivilege 1636 wmic.exe Token: SeIncBasePriorityPrivilege 1636 wmic.exe Token: SeCreatePagefilePrivilege 1636 wmic.exe Token: SeBackupPrivilege 1636 wmic.exe Token: SeRestorePrivilege 1636 wmic.exe Token: SeShutdownPrivilege 1636 wmic.exe Token: SeDebugPrivilege 1636 wmic.exe Token: SeSystemEnvironmentPrivilege 1636 wmic.exe Token: SeRemoteShutdownPrivilege 1636 wmic.exe Token: SeUndockPrivilege 1636 wmic.exe Token: SeManageVolumePrivilege 1636 wmic.exe Token: 33 1636 wmic.exe Token: 34 1636 wmic.exe Token: 35 1636 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2564 wrote to memory of 1636 2564 p.exe 32 PID 2564 wrote to memory of 1636 2564 p.exe 32 PID 2564 wrote to memory of 1636 2564 p.exe 32 PID 2564 wrote to memory of 1636 2564 p.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\p.exe"C:\Users\Admin\AppData\Local\Temp\p.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1636
-