7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1

Analysis

max time kernel
92s
max time network
94s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1N.exe
Size

236KB
MD5

e9121e82551fcb522d60ecc290424bb0
SHA1

d38b084ceff2fa7a6cabf200344a5956bc8a97d4
SHA256

7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1
SHA512

444dcaebe6e4a1a55df99732d5171bc8b2b4d2e25bac1c3bb0d4a39a4034ae56a1959e7431ffe4500eab004638cbf3b67ff0d79f4951e54bb74b32ea0c70a62b
SSDEEP

3072:+J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/Q/FnncroP9:CwDeM7iNEkgiOb31k1ECeJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2636-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/2636-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1N.exe

C:\Users\Admin\AppData\Local\Temp\7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1N.exe
"C:\Users\Admin\AppData\Local\Temp\7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-vf4vSOWovTZNFfZi.exe

Filesize
236KB

MD5
039b887958f1da32badb8dcb09a49b05

SHA1
e5ff5c0930bfe8c9aaf49b3111c924de5f7f248b

SHA256
54cc04c40934afd0d2bb5ebd50e76b7137661b1303b6d46f7abc95011ea82c4b

SHA512
7a7ed57d3178ce6935bd22d042ba0ec7a7f18f3d1f6187ded8b18f5717580fab5c6a35bd29ff803844460d60772cc0688cec74b5f884816581d74eb978fe0263

Download Submit
memory/2636-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2636-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download