7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1

Analysis

max time kernel
101s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1N.exe
Size

236KB
MD5

e9121e82551fcb522d60ecc290424bb0
SHA1

d38b084ceff2fa7a6cabf200344a5956bc8a97d4
SHA256

7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1
SHA512

444dcaebe6e4a1a55df99732d5171bc8b2b4d2e25bac1c3bb0d4a39a4034ae56a1959e7431ffe4500eab004638cbf3b67ff0d79f4951e54bb74b32ea0c70a62b
SSDEEP

3072:+J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/Q/FnncroP9:CwDeM7iNEkgiOb31k1ECeJ/F

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4400-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4400-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0041000000023487-7.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1N.exe

C:\Users\Admin\AppData\Local\Temp\7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1N.exe
"C:\Users\Admin\AppData\Local\Temp\7f2fd0d177d2e93e0784031d700a2f9f5175c939fb3bfd850aa66f4323d9ddd1N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-O2w1xf01glCQOjNv.exe

Filesize
236KB

MD5
855f514437cae38820c3667a7d0937c0

SHA1
fb9a171ef507c3a8d81daabe7ebcd36a404b5976

SHA256
adda434b5a234d64e9d5da315f9e14bcd0952df3a0b78520e0ce539a053b3b4f

SHA512
a183cbe6b5e7c0d0e2c8071d27ee6d7e49a48fa9f183621a986ea5a94a49f7bf5ad3ec855318ecedf5b0ee83c14d40fd40895dafc30953558928507e2bef54a6

Download Submit
memory/4400-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4400-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download