97b4583f626bf10fa9702567ef2b0c1fb4720291ef02f131b84a5c473dae439b

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SoftWare V2.1.7.exe
Size

620KB
MD5

553d2164ba72fd00fc1583e6c1537491
SHA1

0f58db9c4639f61324278b87fb4976f23ee4c5fe
SHA256

15be6cc47f2dfda06ccac645c1bade87bd59028ec2a572eb905b7f5a81e8c0e4
SHA512

096972b9333ccb379a82378036f4e1fc1b404d4768b430dce89035e6bce04311ff4e4c7498fd4a12e4409f86d5710546263218bfcf6a23ca217e48b4d0cc81fa
SSDEEP

12288:r82UNTMlKa8IjOv43y9THoifOZ3V81Sh9ZCHwok5ujLVPKS9vdldPgDiJzzZM1H9:wdTMDvjOv4KH/OZyue

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2404	SoftWare V2.1.7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftWare V2.1.7.exe

C:\Users\Admin\AppData\Local\Temp\SoftWare V2.1.7.exe
"C:\Users\Admin\AppData\Local\Temp\SoftWare V2.1.7.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
470KB

MD5
3a29a2f55ffd9092b36aea7c813833c6

SHA1
35e01a0e12305b711d2b0143e3010723a460da7a

SHA256
759933c77469e5a7a2d78e4b1bf7c8822d707052797f6a8abc64c6da451d5f5f

SHA512
575ad488592daff53262ae90c86d978202f6cd9f77e456f5b8b0c3b930965773900a00e3e4d6df30a4b7742e87a4cc217d56d549b4ada43de096c63b03f78281

Download Submit
memory/2404-0-0x000000007409E000-0x000000007409F000-memory.dmp

Filesize
4KB

Download
memory/2404-1-0x0000000001330000-0x00000000013D2000-memory.dmp

Filesize
648KB

Download
memory/2404-2-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2404-7-0x00000000758A0000-0x0000000075961000-memory.dmp

Filesize
772KB

Download