Analysis
-
max time kernel
125s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/03/2025, 05:57
General
-
Target
201132531919.exe
-
Size
100.2MB
-
MD5
f73aaab0b275bf26372ce81e72730b8f
-
SHA1
348d87d753298b9d931f41edcd8bf337feb04e2e
-
SHA256
18a18eb08a0a4dd85e4ad126e110687b0d70e04c60f7a14f088780aeaaf339a4
-
SHA512
9ac22eed0fa5d946086782e11be9ebe1cb26f85f68b989f82c5a445ba341d5078b8d6c1fa31349e7e89d67ecd4f94254ea0bcd969ae2c8336110faa2b427c95e
-
SSDEEP
3072:mI1WbJFtqTZ805ealC0WHACFOXvwtRST2kM3J5O3ttUtQhJrkm:p1+FtqMaMdACgv3T2Z3JI3ttzJQm
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\201132531919.exe"C:\Users\Admin\AppData\Local\Temp\201132531919.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses