Overview
overview
3Static
static
3.svn/prist...fe.vbs
windows7-x64
1.svn/prist...fe.vbs
windows10-2004-x64
1.svn/prist...92b.js
windows7-x64
3.svn/prist...92b.js
windows10-2004-x64
3.svn/prist...87.vbs
windows7-x64
1.svn/prist...87.vbs
windows10-2004-x64
1.svn/prist...4bf.js
windows7-x64
3.svn/prist...4bf.js
windows10-2004-x64
3.svn/prist...05.exe
windows7-x64
1.svn/prist...05.exe
windows10-2004-x64
3.svn/prist...n-base
windows7-x64
3.svn/prist...n-base
windows10-2004-x64
3.svn/prist...4e3.js
windows7-x64
3.svn/prist...4e3.js
windows10-2004-x64
3.svn/prist...e5.jar
windows7-x64
1.svn/prist...e5.jar
windows10-2004-x64
1.svn/prist...a8d.js
windows7-x64
3.svn/prist...a8d.js
windows10-2004-x64
3.svn/prist...7b.dll
windows7-x64
1.svn/prist...7b.dll
windows10-2004-x64
1.svn/prist...b3.dll
windows7-x64
1.svn/prist...b3.dll
windows10-2004-x64
1.svn/prist...61.dll
windows7-x64
1.svn/prist...61.dll
windows10-2004-x64
1.svn/prist...35a.js
windows7-x64
3.svn/prist...35a.js
windows10-2004-x64
3.svn/prist...6b.dll
windows7-x64
1.svn/prist...6b.dll
windows10-2004-x64
1.svn/prist...439.js
windows7-x64
3.svn/prist...439.js
windows10-2004-x64
3BS柜台/w...OT.jar
windows7-x64
1BS柜台/w...OT.jar
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 04:13
Static task
static1
Behavioral task
behavioral1
Sample
.svn/pristine/0e/0e7891b26a789cc8af77007c3d537578760186fe.vbs
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
.svn/pristine/0e/0e7891b26a789cc8af77007c3d537578760186fe.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
.svn/pristine/2e/2e8de1b7760e5e1149b191ef4c1248dbaf7b492b.js
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
.svn/pristine/2e/2e8de1b7760e5e1149b191ef4c1248dbaf7b492b.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
.svn/pristine/3e/3e655173c859c7cd0e06d366832a7ad41637fe87.vbs
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
.svn/pristine/3e/3e655173c859c7cd0e06d366832a7ad41637fe87.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
.svn/pristine/42/42f3a273acd6894908ae02a9520bd0d7ffe9f4bf.js
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
.svn/pristine/42/42f3a273acd6894908ae02a9520bd0d7ffe9f4bf.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
.svn/pristine/43/4342c65488d30cc4bc0cb8334a4c8392ea25be05.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
.svn/pristine/43/4342c65488d30cc4bc0cb8334a4c8392ea25be05.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
.svn/pristine/6e/6ee3f423fc76ff707da73be265e51895a2469846.svn-base
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
.svn/pristine/6e/6ee3f423fc76ff707da73be265e51895a2469846.svn-base
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
.svn/pristine/6f/6f1fdec79e4c2e022ecfd6783ba6ea6d26a6b4e3.js
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
.svn/pristine/6f/6f1fdec79e4c2e022ecfd6783ba6ea6d26a6b4e3.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
.svn/pristine/c1/c14dec4b3eeabde24e01a04e5ae9ffd09b6184e5.jar
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
.svn/pristine/c1/c14dec4b3eeabde24e01a04e5ae9ffd09b6184e5.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
.svn/pristine/d6/d6e859cde52de00c465bc557f74c680326f52a8d.js
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
.svn/pristine/d6/d6e859cde52de00c465bc557f74c680326f52a8d.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
.svn/pristine/d7/d7dc81ec62a606759c67e505580cf77abb90a57b.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
.svn/pristine/d7/d7dc81ec62a606759c67e505580cf77abb90a57b.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
.svn/pristine/df/df309cc097267c6f7210719b299df460130252b3.dll
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
.svn/pristine/df/df309cc097267c6f7210719b299df460130252b3.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
.svn/pristine/ef/ef3816388080677e0851835f30b4bd0d592d4861.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
.svn/pristine/ef/ef3816388080677e0851835f30b4bd0d592d4861.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
.svn/pristine/ef/efb42b31779b5e957034a9791e1795e15083335a.js
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
.svn/pristine/ef/efb42b31779b5e957034a9791e1795e15083335a.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
.svn/pristine/f1/f16d8079c2c4b5dcd24d63205c8096b2bda19e6b.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
.svn/pristine/f1/f16d8079c2c4b5dcd24d63205c8096b2bda19e6b.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
.svn/pristine/fc/fcdcf074b063135fd342935323940f80e39b9439.js
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
.svn/pristine/fc/fcdcf074b063135fd342935323940f80e39b9439.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
BS柜台/websale_dx/WEB-INF/lib/kdsale-1.0-SNAPSHOT.jar
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
BS柜台/websale_dx/WEB-INF/lib/kdsale-1.0-SNAPSHOT.jar
Resource
win10v2004-20240802-en
General
-
Target
.svn/pristine/43/4342c65488d30cc4bc0cb8334a4c8392ea25be05.exe
-
Size
432KB
-
MD5
58d921f945d793ed846b4631d7d5e9b8
-
SHA1
4342c65488d30cc4bc0cb8334a4c8392ea25be05
-
SHA256
4e00ad832b83d9975526f906f0aed1814c4081511695e29337a2ee14a3c67f06
-
SHA512
9307478c41c7874352b192e130d005954026e55af7d149c51d6bdd11349d9f72c60f0a4ff6a227eac0ae5c3fb15453676ab9c2325fe9e809e9769a5b6e0a03f9
-
SSDEEP
12288:Kfr0Gf9PJOu60dUvrNxRbkiMY1uMS1mW4LlrtF5Tsfem:EZMScW4Llr+f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4342c65488d30cc4bc0cb8334a4c8392ea25be05.exe