Overview
overview
10Static
static
7Setup-pass...up.exe
windows7-x64
10Setup-pass...up.exe
windows10-1703-x64
10Setup-pass...up.exe
windows10-2004-x64
10Setup-pass...up.exe
windows11-21h2-x64
10Setup-pass...a0.exe
windows7-x64
3Setup-pass...a0.exe
windows10-1703-x64
3Setup-pass...a0.exe
windows10-2004-x64
3Setup-pass...a0.exe
windows11-21h2-x64
3Analysis
-
max time kernel
144s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26-08-2024 17:31
Behavioral task
behavioral1
Sample
Setup-pass-2024/Setup.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Setup-pass-2024/Setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Setup-pass-2024/Setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Setup-pass-2024/Setup.exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Setup-pass-2024/data0.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Setup-pass-2024/data0.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Setup-pass-2024/data0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
Setup-pass-2024/data0.exe
Resource
win11-20240802-en
General
-
Target
Setup-pass-2024/data0.exe
-
Size
215.4MB
-
MD5
38bdb3bd2750ca072241925a597ce576
-
SHA1
06045b51bc40ca8379ad17528b07b361818f9d92
-
SHA256
23e498c4034d6c072dfc451550972a99b2c7f313f8e2aba2d1cd0804e6e76b6f
-
SHA512
31ed4aa225f28ca1ad037438556607b07c3aac42df4b8c74293d9989e27daa84f58a78299ab9583a92842183770b2461bdfb9c49e1a040d1a3621bd154f3e522
-
SSDEEP
6291456:yJb4T8zKsfV47DGFnjMf28iHLn6CHizQbWhTp4:ib4TsK6i3yQeTH7jHizQITp4
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
data0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language data0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
data0.exepid process 2408 data0.exe