e7151251ffdd03538df56050ab37f5a8c4274263ee6dfe62d903d7e732fa604a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7151251ffdd03538df56050ab37f5a8c4274263ee6dfe62d903d7e732fa604a.exe
Size

57KB
MD5

1063e7cfaac38736af7f0c3ca43cf402
SHA1

c5429734ebbbba2245d3d8918cfc7725ff234b0a
SHA256

e7151251ffdd03538df56050ab37f5a8c4274263ee6dfe62d903d7e732fa604a
SHA512

778cb2b10ea3b0ec1eabc430ea8251be3b62fe7b8a69d15251a7c5495ef61114381f142507fbf70614f49c5637f56e0904ff81d665d717c36bb79de56d83e2ea
SSDEEP

768:4oMn6f9zSX3e3cZ9SoD8XD33fyEpk58sCuSNcIcXR/QGQeCa57qEQwLGVPl2C8Er:26f9uusDSoDEXC58kSEYFa1vnLaltaRO

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	e7151251ffdd03538df56050ab37f5a8c4274263ee6dfe62d903d7e732fa604a.exe

Executes dropped EXE 1 IoCs

pid	Process
3176	upsec.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3820-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x000c000000023b30-8.dat	upx
behavioral2/memory/3820-13-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3176-16-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upsec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7151251ffdd03538df56050ab37f5a8c4274263ee6dfe62d903d7e732fa604a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 3176	3820	e7151251ffdd03538df56050ab37f5a8c4274263ee6dfe62d903d7e732fa604a.exe	82
PID 3820 wrote to memory of 3176	3820	e7151251ffdd03538df56050ab37f5a8c4274263ee6dfe62d903d7e732fa604a.exe	82
PID 3820 wrote to memory of 3176	3820	e7151251ffdd03538df56050ab37f5a8c4274263ee6dfe62d903d7e732fa604a.exe	82

C:\Users\Admin\AppData\Local\Temp\e7151251ffdd03538df56050ab37f5a8c4274263ee6dfe62d903d7e732fa604a.exe
"C:\Users\Admin\AppData\Local\Temp\e7151251ffdd03538df56050ab37f5a8c4274263ee6dfe62d903d7e732fa604a.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\upsec.exe
  "C:\Users\Admin\AppData\Local\Temp\upsec.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\upsec.exe

Filesize
58KB

MD5
b5d20a7bdc76565dd84a2b950a0d567c

SHA1
01698740037d7386876eb6aa005132eaf35b2d02

SHA256
aab6ec0445f2a6e3623a139d473faa4c1f34b7ba377acc9b7a2ba9d9c4ea4034

SHA512
3f16716c990762217c5b8190b18aec37a1663a6c89d61150b85a0e28d0acfe9308372106dbefab9227b3562f139bdfe065553e751dd201f960fe5f549f1acb40

Download Submit
memory/3176-16-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3176-18-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/3820-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3820-1-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/3820-3-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/3820-2-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/3820-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download