Analysis
-
max time kernel
10s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-02-2025 09:55
Behavioral task
behavioral1
Sample
r.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
r.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
r.exe
-
Size
3.7MB
-
MD5
8b0d28eb3818bcd456f1b1aefc00e963
-
SHA1
90293997a77479780afde11e12562771a45620aa
-
SHA256
51b4207ed9ef06a4c50808e933fc01ad1eb30613bd65702427bbeddac4c5dc25
-
SHA512
dbf31aa7b42b2575efdeabcef47b9c4513becfedad9569fda7df9c39b8e10d214e8deaf1c0411c80b4359cd67621e6ec21ebb9a1178aea4900303881e0c0433c
-
SSDEEP
49152:N8o8bZjyJVD0s9Mr3XIfRviWkgEOaxfCbCMcXGtSgvZPOQ5Q9:N8o8VOUs9joRbMc2tSW69
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2724 wmic.exe Token: SeSecurityPrivilege 2724 wmic.exe Token: SeTakeOwnershipPrivilege 2724 wmic.exe Token: SeLoadDriverPrivilege 2724 wmic.exe Token: SeSystemProfilePrivilege 2724 wmic.exe Token: SeSystemtimePrivilege 2724 wmic.exe Token: SeProfSingleProcessPrivilege 2724 wmic.exe Token: SeIncBasePriorityPrivilege 2724 wmic.exe Token: SeCreatePagefilePrivilege 2724 wmic.exe Token: SeBackupPrivilege 2724 wmic.exe Token: SeRestorePrivilege 2724 wmic.exe Token: SeShutdownPrivilege 2724 wmic.exe Token: SeDebugPrivilege 2724 wmic.exe Token: SeSystemEnvironmentPrivilege 2724 wmic.exe Token: SeRemoteShutdownPrivilege 2724 wmic.exe Token: SeUndockPrivilege 2724 wmic.exe Token: SeManageVolumePrivilege 2724 wmic.exe Token: 33 2724 wmic.exe Token: 34 2724 wmic.exe Token: 35 2724 wmic.exe Token: SeIncreaseQuotaPrivilege 2724 wmic.exe Token: SeSecurityPrivilege 2724 wmic.exe Token: SeTakeOwnershipPrivilege 2724 wmic.exe Token: SeLoadDriverPrivilege 2724 wmic.exe Token: SeSystemProfilePrivilege 2724 wmic.exe Token: SeSystemtimePrivilege 2724 wmic.exe Token: SeProfSingleProcessPrivilege 2724 wmic.exe Token: SeIncBasePriorityPrivilege 2724 wmic.exe Token: SeCreatePagefilePrivilege 2724 wmic.exe Token: SeBackupPrivilege 2724 wmic.exe Token: SeRestorePrivilege 2724 wmic.exe Token: SeShutdownPrivilege 2724 wmic.exe Token: SeDebugPrivilege 2724 wmic.exe Token: SeSystemEnvironmentPrivilege 2724 wmic.exe Token: SeRemoteShutdownPrivilege 2724 wmic.exe Token: SeUndockPrivilege 2724 wmic.exe Token: SeManageVolumePrivilege 2724 wmic.exe Token: 33 2724 wmic.exe Token: 34 2724 wmic.exe Token: 35 2724 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 816 wrote to memory of 2724 816 r.exe 31 PID 816 wrote to memory of 2724 816 r.exe 31 PID 816 wrote to memory of 2724 816 r.exe 31 PID 816 wrote to memory of 2724 816 r.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\r.exe"C:\Users\Admin\AppData\Local\Temp\r.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2724
-