5015af8fb5725c4c9ebac28a890128587b888acddab6cc9ff06e94e782713882

Submit
Reports

Overview

overview

Static

static

ScreenCapt...r1.exe

windows7-x64

ScreenCapt...r2.exe

windows7-x64

ScreenCapt...rt.exe

windows7-x64

ScreenCapt...er.exe

windows7-x64

ScreenCapt...ck.exe

windows7-x64

ScreenCapt...k1.exe

windows7-x64

ScreenCapt...k2.exe

windows7-x64

Setup (5).exe

windows7-x64

Setup (6).exe

windows7-x64

Supplement...16.scr

windows7-x64

T1.exe

windows7-x64

T1_b7afca7...b5.exe

windows7-x64

TeenTube_90767.exe

windows7-x64

Trojan-Ran....a.exe

windows7-x64

Tuyen bo c...ed.doc

windows7-x64

Tuyen bo c...ed.doc

windows7-x64

UNPACKED.exe

windows7-x64

Uninstall (2).exe

windows7-x64

Uninstall.exe

windows7-x64

Upx.exe

windows7-x64

screenshot2016.exe

windows7-x64

sidacertification.exe

windows7-x64

spora.exe

windows7-x64

svhost.exe

windows7-x64

sys100s.exe_.exe

windows7-x64

tordll.dll

windows7-x64

uacbypass.exe

windows7-x64

unpack.exe

windows7-x64

unpacked.ex_.exe

windows7-x64

unpacked.mem.exe

windows7-x64

upd.exe

windows7-x64

verhdiehndi.bat

windows7-x64

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:39

Sharing

Copy URL

Twitter E-mail

Static task

static1

5 signatures

Behavioral task

behavioral1

Sample

ScreenCapture_Win8.MalwareScanner1.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral2

Sample

ScreenCapture_Win8.MalwareScanner2.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral3

Sample

ScreenCapture_Win8.PopupAlert.exe

Resource

win7-20241010-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral4

Sample

ScreenCapture_Win8.TaskServer.exe

Resource

win7-20241023-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral5

Sample

ScreenCapture_Win8.WindowsLock.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral6

Sample

ScreenCapture_Win8.WindowsLock1.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral7

Sample

ScreenCapture_Win8.WindowsLock2.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral8

Sample

Setup (5).exe

Resource

win7-20240903-en

discovery persistence

windows7-x64

10 signatures

300 seconds

Behavioral task

behavioral9

Sample

Setup (6).exe

Resource

win7-20240903-en

discovery persistence

windows7-x64

10 signatures

300 seconds

Behavioral task

behavioral10

Sample

Supplementary Agreement 26_01_2016.scr

Resource

win7-20240708-en

discovery

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral11

Sample

T1.exe

Resource

win7-20240903-en

t1happy credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

windows7-x64

24 signatures

300 seconds

Behavioral task

behavioral12

Sample

T1_b7afca788487347804156f052c613db5.exe

Resource

win7-20240903-en

t1happy credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

windows7-x64

19 signatures

300 seconds

Behavioral task

behavioral13

Sample

TeenTube_90767.exe

Resource

win7-20240729-en

discovery persistence

windows7-x64

7 signatures

300 seconds

Behavioral task

behavioral14

Sample

Trojan-Ransom.Win32.Telecrypt.a.exe

Resource

win7-20241010-en

discovery

windows7-x64

2 signatures

300 seconds

Behavioral task

behavioral15

Sample

Tuyen bo chung Viet Nam - Hoa Ky - Infected and EnCrypted.doc

Resource

win7-20241010-en

discovery

windows7-x64

8 signatures

300 seconds

Behavioral task

behavioral16

Sample

Tuyen bo chung Viet Nam - Hoa Ky - Infected.doc

Resource

win7-20240903-en

discovery

windows7-x64

9 signatures

300 seconds

Behavioral task

behavioral17

Sample

UNPACKED.exe

Resource

win7-20241023-en

discovery persistence ransomware spyware stealer

windows7-x64

11 signatures

300 seconds

Behavioral task

behavioral18

Sample

Uninstall (2).exe

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral19

Sample

Uninstall.exe

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral20

Sample

Upx.exe

Resource

win7-20241010-en

upx

windows7-x64

1 signatures

300 seconds

Behavioral task

behavioral21

Sample

screenshot2016.exe

Resource

win7-20240903-en

windows7-x64

7 signatures

300 seconds

Behavioral task

behavioral22

Sample

sidacertification.exe

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral23

Sample

spora.exe

Resource

win7-20240903-en

defense_evasion discovery evasion execution impact ransomware spyware stealer

windows7-x64

16 signatures

300 seconds

Behavioral task

behavioral24

Sample

svhost.exe

Resource

win7-20240708-en

defense_evasion discovery persistence upx

windows7-x64

12 signatures

300 seconds

Behavioral task

behavioral25

Sample

sys100s.exe_.exe

Resource

win7-20240903-en

defense_evasion discovery persistence ransomware spyware stealer

windows7-x64

15 signatures

300 seconds

Behavioral task

behavioral26

Sample

tordll.dll

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

300 seconds

Behavioral task

behavioral27

Sample

uacbypass.exe

Resource

win7-20240729-en

discovery

windows7-x64

1 signatures

300 seconds

Behavioral task

behavioral28

Sample

unpack.exe

Resource

win7-20240903-en

defense_evasion discovery persistence

windows7-x64

7 signatures

300 seconds

Behavioral task

behavioral29

Sample

unpacked.ex_.exe

Resource

win7-20240903-en

discovery persistence ransomware spyware stealer

windows7-x64

11 signatures

300 seconds

Behavioral task

behavioral30

Sample

unpacked.mem.exe

Resource

win7-20240903-en

troldesh discovery persistence ransomware trojan

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral31

Sample

upd.exe

Resource

win7-20241010-en

discovery persistence

windows7-x64

8 signatures

300 seconds

Behavioral task

behavioral32

Sample

verhdiehndi.bat

Resource

win7-20240903-en

dropper

windows7-x64

2 signatures

300 seconds

Report Analysis Logs

General

Target

uacbypass.exe
Size

24KB
MD5

d469a87f9b996a9f898f437a72668d11
SHA1

f63f8f8fad87bd53d5ec3d5365952d4f84b1781c
SHA256

8c1fb2fe36a122f0c47b8bda438dfa69395587ca459823b7cb88e167cf3e9605
SHA512

3e9fb5f519225bcd4e7b3e86ba54ded9794cc2c6d760f21fd2d02f7045e918dd7d54ed5a24c7d6e61acebc27a6d3dd6419f80e90b8dfdfadf1fe9a29611b87b5
SSDEEP

192:ALKf4my3ssAnktY67AN3BwQbqVx9XA3TzbXun2DYVFkakH9Dqy8RN6cE7H5s4HnL:+/18s1tvHAqVDSDYBkdOJb67BHnFp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uacbypass.exe

Processes

C:\Users\Admin\AppData\Local\Temp\uacbypass.exe
"C:\Users\Admin\AppData\Local\Temp\uacbypass.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads