7eb6ba9644c01f9ce9716f7aea8b90aae0f986279e6d3a798f158a6bc4495443

Analysis

max time kernel
32s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2edbac4f341f031a44886d3990ef8b80N.exe
Size

29KB
MD5

2edbac4f341f031a44886d3990ef8b80
SHA1

c41a2584f0c455d83bba6f662ad95a4801e83c93
SHA256

7eb6ba9644c01f9ce9716f7aea8b90aae0f986279e6d3a798f158a6bc4495443
SHA512

6844cd6957ff04f15458b195ab8449dd6bf578b96c06905d8e00a56d6da465836364be70f1d72d2d67cfc8fd3112982cc0d2f68ce9efe8d0a27e3f9769869f84
SSDEEP

768:ITRfpN0pOy3OzeXmOGXbJOlB2vsLCik5dAy7b6lSKQ:IHzzeWHXbJGB2EOik5h36lNQ

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2724-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x0008000000014c65-5.dat	upx
behavioral1/memory/2724-102-0x0000000000400000-0x000000000041A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2edbac4f341f031a44886d3990ef8b80N.exe

C:\Users\Admin\AppData\Local\Temp\2edbac4f341f031a44886d3990ef8b80N.exe
"C:\Users\Admin\AppData\Local\Temp\2edbac4f341f031a44886d3990ef8b80N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\My Downloads\KaZaA Spyware Remover Key Generator.exe

Filesize
29KB

MD5
faa4dcc645daf1ade7ef0961c9ee4e5b

SHA1
bdbf9c1f8ff711a2195742e6d2947a029f3daf5f

SHA256
3f58ff78e0615ba1d27ce94f9b8f042ba25cb56ee1507b9436e9d59d0053696e

SHA512
84caa1a29da0e26101cdf4cd560d4d799dbbf999f3dccd6053be4e8e7d335c12c48d23105dba0c84566f1460e46bae6774b65984b9f179bd7711633a0c0bf561

Download Submit
memory/2724-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2724-102-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download