745f0191c929b92f6e599591f842ab377c9cc20a70195c853640d3f4b046c231

Analysis

max time kernel
119s
max time network
93s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 05:24

Target

9806f67b0b192a37e5bdae7180b6c700N.exe
Size

236KB
MD5

9806f67b0b192a37e5bdae7180b6c700
SHA1

14ad65924d255e4e61abbaf34d5f415e65c738fb
SHA256

745f0191c929b92f6e599591f842ab377c9cc20a70195c853640d3f4b046c231
SHA512

36759cb4637828c91a631da65d46f378ac893c5b38d621f2b3e14aa936d8be2e7fa71ae7a812376cb6c7d8c72f950ded3ac3f5968e86c46ca57bd9c009e52830
SSDEEP

3072:4J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/c/FnncroP9:8wDeM7iNEkgiOb31k1ECaJ/F

Score

7^/10

discovery upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1944-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1944-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\rifaien2-wWRuIsLYBYU75iaR.exe	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

9806f67b0b192a37e5bdae7180b6c700N.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9806f67b0b192a37e5bdae7180b6c700N.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9806f67b0b192a37e5bdae7180b6c700N.exe

C:\Users\Admin\AppData\Local\Temp\9806f67b0b192a37e5bdae7180b6c700N.exe
"C:\Users\Admin\AppData\Local\Temp\9806f67b0b192a37e5bdae7180b6c700N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1944

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\rifaien2-wWRuIsLYBYU75iaR.exe

Filesize
236KB

MD5
0bdc604f2ce7a05519018baa3e273e1e

SHA1
4b9a17fe97b85cd7497397f594adb71935530374

SHA256
36771c70f44eba81af2e8d00444aabca035c281125146f7ea15ba613bb518c48

SHA512
a677d3cfa7be81d5dd1bc259317b5096687b8b72ca8bf679743afa297f8053d905cd7c5c2714fd27e1971f25538403d1190dea74dfd92aa8c0d5ac6759ddcdd7

Download Submit
memory/1944-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1944-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download