745f0191c929b92f6e599591f842ab377c9cc20a70195c853640d3f4b046c231

Analysis

max time kernel
111s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 05:24

Target

9806f67b0b192a37e5bdae7180b6c700N.exe
Size

236KB
MD5

9806f67b0b192a37e5bdae7180b6c700
SHA1

14ad65924d255e4e61abbaf34d5f415e65c738fb
SHA256

745f0191c929b92f6e599591f842ab377c9cc20a70195c853640d3f4b046c231
SHA512

36759cb4637828c91a631da65d46f378ac893c5b38d621f2b3e14aa936d8be2e7fa71ae7a812376cb6c7d8c72f950ded3ac3f5968e86c46ca57bd9c009e52830
SSDEEP

3072:4J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/c/FnncroP9:8wDeM7iNEkgiOb31k1ECaJ/F

Score

7^/10

discovery upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4524-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4524-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\rifaien2-TX0DhEUDYLKzdTW6.exe	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

9806f67b0b192a37e5bdae7180b6c700N.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9806f67b0b192a37e5bdae7180b6c700N.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9806f67b0b192a37e5bdae7180b6c700N.exe

C:\Users\Admin\AppData\Local\Temp\9806f67b0b192a37e5bdae7180b6c700N.exe
"C:\Users\Admin\AppData\Local\Temp\9806f67b0b192a37e5bdae7180b6c700N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4524

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\rifaien2-TX0DhEUDYLKzdTW6.exe

Filesize
236KB

MD5
58d2530c307b91ce768d76f1c162121b

SHA1
a858d570ee9c87c249563cffa1509c26c066bb03

SHA256
d6845e0148a402366194364b45b2c0b7d4122471dc6ee114ff133b1b5ed5a0ad

SHA512
6ca830e75ad22247b7c84d38d0f5c5ee2f0c710f00979d6173925db7c1a832ee09a720021a8b471b867d47d771b7073bfc42a900dc92fd513ec7d0e4e3a9ecae

Download Submit
memory/4524-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4524-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download