ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372

General

Target

ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
Size

372KB
MD5

19937ad01f3fc2fe28941feb4c110ee8
SHA1

46376eb5c9f27d82a7a43d7eca08553b18d72e60
SHA256

ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372
SHA512

d547496f9f7e520f3b558fc0e918ebe1ee384084aa4d9c849c28fc097697017ce4753d1a1a2957d4f99511ab90415f9b0017931267cc82120aa46151355ba782
SSDEEP

6144:tqdgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiKu:tAqQx+H2i+8LBNbdypazCXY8

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 1592	2136	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe	31

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
File opened for modification	C:\Windows\win.ini	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2136	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
2136	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
1592	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
1592	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2136	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
2136	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
1592	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
1592	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2136	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
1592	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1592	2136	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe	31
PID 2136 wrote to memory of 1592	2136	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe	31
PID 2136 wrote to memory of 1592	2136	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe	31
PID 2136 wrote to memory of 1592	2136	ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe	31

C:\Users\Admin\AppData\Local\Temp\ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
"C:\Users\Admin\AppData\Local\Temp\ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe
  "C:\Users\Admin\AppData\Local\Temp\ae5f2c9942b61b2f7282dd970e410f373e8cf50429c19dc7da38080513b5c372.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1592
- - C:\Users\Admin\AppData\Local\Temp\hab.exe
    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
    3⤵
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\hab.exe
      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
      4⤵
      PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
93732398e9b962c5f394d34a8fefda32

SHA1
fb224bf669b8065b2d97e88e1c53228156512e1c

SHA256
c48d3ded92b7564998957430412fad611a84a422bbbb30b9323cc31dc2af12cf

SHA512
f220c3470933a8d7ef5191f1b28bbff831dc13bb0472716b3853c1941789b1499974f7999f6d983c14b9b39601306827a862629acab575baec5fd7467da6fe38

Download Submit
memory/1592-15-0x0000000077430000-0x00000000775D9000-memory.dmp

Filesize
1.7MB

Download
memory/2136-2-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2136-4-0x0000000077431000-0x0000000077532000-memory.dmp

Filesize
1.0MB

Download
memory/2136-5-0x0000000077430000-0x00000000775D9000-memory.dmp

Filesize
1.7MB

Download
memory/2136-10-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2136-13-0x0000000077620000-0x00000000776F6000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing