090d127ac86f24c23da55c30d476f2acb90fa42369351191065fc8921ab48439

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7151f74584ad1cc065c42d43878c0560N.exe
Size

9.9MB
MD5

7151f74584ad1cc065c42d43878c0560
SHA1

b3d2b1991d01bb72c011a082bd5e811ed680aff8
SHA256

090d127ac86f24c23da55c30d476f2acb90fa42369351191065fc8921ab48439
SHA512

1c72d74ca7437bdf8f8e82b5b0102af8b2ddd88bd1e4940f4e6864d038a6071f2bd1e1990b702862127610d7656f20e87640b26587df1e73413cbab088ed87fd
SSDEEP

98304:2ssssssssssssssssssssssssssssssssX:G

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1660	svrwsc.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3264-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/3264-2-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/files/0x0008000000023486-5.dat	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svrwsc.exe	7151f74584ad1cc065c42d43878c0560N.exe
File created	C:\Windows\SysWOW64\svrwsc.exe	svrwsc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7151f74584ad1cc065c42d43878c0560N.exe

C:\Users\Admin\AppData\Local\Temp\7151f74584ad1cc065c42d43878c0560N.exe
"C:\Users\Admin\AppData\Local\Temp\7151f74584ad1cc065c42d43878c0560N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3264

C:\Windows\SysWOW64\svrwsc.exe
C:\Windows\SysWOW64\svrwsc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svrwsc.exe

Filesize
10.2MB

MD5
a899ef5f660cc344248172fd65c0da7f

SHA1
7da4b826ebbce501fd2442357b681ba5cc875e97

SHA256
028284b00f1690689b082aa5a5e77d2eb18dd43cf33c02f9fa1ed33f354e01f9

SHA512
463929643b8d3be6d7ed8936498287a729db83002e8c276dec0bf2ded84a6f06d16926a75bb552423aa32e9197517c27d28e5a01cde4225bb8bc3330be926f86

Download Submit
memory/1660-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3264-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3264-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/3264-2-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3264-3-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3264-9-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download