7a5fe6838ca4381d94a836f3ef52e39e3b266aa7d6de7842b9a8a5d723caaf43

Analysis

max time kernel
103s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ed873631063680d8cece1eb6ba95dc50N.exe
Size

165KB
MD5

ed873631063680d8cece1eb6ba95dc50
SHA1

769e16e2feb4f35cb74b8a61639d94ee72cdfba0
SHA256

7a5fe6838ca4381d94a836f3ef52e39e3b266aa7d6de7842b9a8a5d723caaf43
SHA512

aaca66a23cfdb1fca8081f217cc4a7b3fa8299045449216217a7a64f53dd9a1a22641096c76903e6f562cd84179c14529762ee58f9621cc98f197df3a9dfcb76
SSDEEP

3072:yxTqpdA3f6QNf2IPO4DpmWpAsfYbTOBoefYi6a9k20tAvKkzkFu0qZ9:02pdqfv2IPOGfXf5ovWvtkUN9

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2452-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/files/0x00070000000234ee-5.dat	upx
behavioral2/memory/2452-102-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\driv64.exe	ed873631063680d8cece1eb6ba95dc50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed873631063680d8cece1eb6ba95dc50N.exe

C:\Users\Admin\AppData\Local\Temp\ed873631063680d8cece1eb6ba95dc50N.exe
"C:\Users\Admin\AppData\Local\Temp\ed873631063680d8cece1eb6ba95dc50N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\CKY3 - Bam Margera World Industries Alien Workshop Full Downloader.exe

Filesize
165KB

MD5
ed873631063680d8cece1eb6ba95dc50

SHA1
769e16e2feb4f35cb74b8a61639d94ee72cdfba0

SHA256
7a5fe6838ca4381d94a836f3ef52e39e3b266aa7d6de7842b9a8a5d723caaf43

SHA512
aaca66a23cfdb1fca8081f217cc4a7b3fa8299045449216217a7a64f53dd9a1a22641096c76903e6f562cd84179c14529762ee58f9621cc98f197df3a9dfcb76

Download Submit
memory/2452-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2452-102-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download