Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-02-2025 09:55
Behavioral task
behavioral1
Sample
c.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
c.exe
-
Size
3.7MB
-
MD5
34bacef5e0b44c55a9b293d0cc67220b
-
SHA1
c898260acb34f3dd2e7212109282154e15776091
-
SHA256
915a9ac1222489326e5ae312ca3365a86587f264794a1b0bdc7f4b18a6de1962
-
SHA512
61a60ab79a50dd7b13ba5c8ca6886fb8501e5ca1de3185d8ccf33e95da3c5422a741c093edf722d5d9d5ac67094313c454182e158203f3a0df68325381b62fea
-
SSDEEP
49152:F8o8bZjyJVD0s9Mr3XIfRviWkgEOaxfCbCMcXGtSgvZPOQ5Qo:F8o8VOUs9joRbMc2tSW6o
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3052 wmic.exe Token: SeSecurityPrivilege 3052 wmic.exe Token: SeTakeOwnershipPrivilege 3052 wmic.exe Token: SeLoadDriverPrivilege 3052 wmic.exe Token: SeSystemProfilePrivilege 3052 wmic.exe Token: SeSystemtimePrivilege 3052 wmic.exe Token: SeProfSingleProcessPrivilege 3052 wmic.exe Token: SeIncBasePriorityPrivilege 3052 wmic.exe Token: SeCreatePagefilePrivilege 3052 wmic.exe Token: SeBackupPrivilege 3052 wmic.exe Token: SeRestorePrivilege 3052 wmic.exe Token: SeShutdownPrivilege 3052 wmic.exe Token: SeDebugPrivilege 3052 wmic.exe Token: SeSystemEnvironmentPrivilege 3052 wmic.exe Token: SeRemoteShutdownPrivilege 3052 wmic.exe Token: SeUndockPrivilege 3052 wmic.exe Token: SeManageVolumePrivilege 3052 wmic.exe Token: 33 3052 wmic.exe Token: 34 3052 wmic.exe Token: 35 3052 wmic.exe Token: SeIncreaseQuotaPrivilege 3052 wmic.exe Token: SeSecurityPrivilege 3052 wmic.exe Token: SeTakeOwnershipPrivilege 3052 wmic.exe Token: SeLoadDriverPrivilege 3052 wmic.exe Token: SeSystemProfilePrivilege 3052 wmic.exe Token: SeSystemtimePrivilege 3052 wmic.exe Token: SeProfSingleProcessPrivilege 3052 wmic.exe Token: SeIncBasePriorityPrivilege 3052 wmic.exe Token: SeCreatePagefilePrivilege 3052 wmic.exe Token: SeBackupPrivilege 3052 wmic.exe Token: SeRestorePrivilege 3052 wmic.exe Token: SeShutdownPrivilege 3052 wmic.exe Token: SeDebugPrivilege 3052 wmic.exe Token: SeSystemEnvironmentPrivilege 3052 wmic.exe Token: SeRemoteShutdownPrivilege 3052 wmic.exe Token: SeUndockPrivilege 3052 wmic.exe Token: SeManageVolumePrivilege 3052 wmic.exe Token: 33 3052 wmic.exe Token: 34 3052 wmic.exe Token: 35 3052 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 3052 2872 c.exe 31 PID 2872 wrote to memory of 3052 2872 c.exe 31 PID 2872 wrote to memory of 3052 2872 c.exe 31 PID 2872 wrote to memory of 3052 2872 c.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c.exe"C:\Users\Admin\AppData\Local\Temp\c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3052
-