Analysis Overview
SHA256
7d74829037cc3430e488432d39a4be0d88844edc5678816288865bedb629f743
Threat Level: Likely benign
The file 7d74829037cc3430e488432d39a4be0d88844edc5678816288865bedb629f743N was found to be: Likely benign.
Malicious Activity Summary
System Location Discovery: System Language Discovery
Unsigned PE
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-09 10:21
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-09 10:21
Reported
2024-11-09 10:23
Platform
win10v2004-20241007-en
Max time kernel
111s
Max time network
92s
Command Line
Signatures
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7d74829037cc3430e488432d39a4be0d88844edc5678816288865bedb629f743N.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\7d74829037cc3430e488432d39a4be0d88844edc5678816288865bedb629f743N.exe
"C:\Users\Admin\AppData\Local\Temp\7d74829037cc3430e488432d39a4be0d88844edc5678816288865bedb629f743N.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | wecan.hasthe.technology | udp |
| US | 172.67.183.40:80 | wecan.hasthe.technology | tcp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 40.183.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 102.209.201.84.in-addr.arpa | udp |
| US | 172.67.183.40:80 | wecan.hasthe.technology | tcp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 172.67.183.40:80 | wecan.hasthe.technology | tcp |
Files
memory/2116-0-0x0000000000400000-0x0000000000427000-memory.dmp
memory/2116-7-0x0000000000400000-0x0000000000427000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\rifaien2-VzGfX1otnbWzYCSk.exe
| MD5 | 6f09e4a493b1af938d59bccddb899049 |
| SHA1 | 30f49fd5091676de06b47db5fb6ab15409a320a9 |
| SHA256 | 2c7487128389bfb7ddf5a6baeff76cee5df99a8cb47a2732c85ef75e2b7967ad |
| SHA512 | 79467447d389ebaedc2226954cb694449ca1ad3b483714f191c3f25b0ab64a10f49c7843b93b5c56ea94858e3d1396cbe69f460ce3d0ca3482da68d9c0ca2d22 |
memory/2116-14-0x0000000000400000-0x0000000000427000-memory.dmp
memory/2116-21-0x0000000000400000-0x0000000000427000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-09 10:21
Reported
2024-11-09 10:23
Platform
win7-20240903-en
Max time kernel
119s
Max time network
120s
Command Line
Signatures
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7d74829037cc3430e488432d39a4be0d88844edc5678816288865bedb629f743N.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\7d74829037cc3430e488432d39a4be0d88844edc5678816288865bedb629f743N.exe
"C:\Users\Admin\AppData\Local\Temp\7d74829037cc3430e488432d39a4be0d88844edc5678816288865bedb629f743N.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | wecan.hasthe.technology | udp |
| US | 172.67.183.40:80 | wecan.hasthe.technology | tcp |
| US | 172.67.183.40:80 | wecan.hasthe.technology | tcp |
| US | 172.67.183.40:80 | wecan.hasthe.technology | tcp |
Files
memory/2008-0-0x0000000000400000-0x0000000000427000-memory.dmp
memory/2008-5-0x0000000000400000-0x0000000000427000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\rifaien2-Kroil4eU8t5WnRwV.exe
| MD5 | 2c3520520ede721ef3f4be08bd4ee314 |
| SHA1 | af12b303dfd078104c1dabd4821d4af3b3652aa8 |
| SHA256 | 6efdf3eebc1462e894a186f844006d4c4c6f53bc3521459215998fabe948f8e4 |
| SHA512 | 16cd19c79bc148af00edeac98e7cfb47dec1245ae7e16d2c3f79bdbdb1823bce6f335667948ad127c2e2116a3281fc6c199c7ad7526e7a1fa07b45a057152ec1 |
memory/2008-13-0x0000000000400000-0x0000000000427000-memory.dmp
memory/2008-21-0x0000000000400000-0x0000000000427000-memory.dmp