Analysis

  • max time kernel
    598s
  • max time network
    600s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 03:25

General

  • Target

    decrypt_0000000000000020-000A0000.exe

  • Size

    611KB

  • MD5

    c81f5b5e057b4a3c7eee9e4d1c4abd53

  • SHA1

    949af2ac0176ae4bcc4c07a41e26094f8ed301aa

  • SHA256

    94f36b586379137a58862ca46cd1cd6c01c20ea9f56755f7b193f0c97b7a57bd

  • SHA512

    541892f2d23a1d3c3324e721764a62aed8191e4ff47ba681684aa251842337b8a8e78d72eee98c73d70bb917e19724ec9671259022b21faad324734fcf462a92

  • SSDEEP

    12288:LSY9aHA9OWHFzHaqxSjxspvZhsKsh+M7:hiA9OWlz6qmx8hnsh+u

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\decrypt_0000000000000020-000A0000.exe
    "C:\Users\Admin\AppData\Local\Temp\decrypt_0000000000000020-000A0000.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2428-3-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-4-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-5-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-6-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-7-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-8-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-9-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-10-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-11-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-12-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-13-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-14-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-15-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-16-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-17-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-18-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-19-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-20-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-21-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-22-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-23-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-24-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-25-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-26-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-27-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-28-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-29-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-30-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-31-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-32-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-33-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-34-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-35-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-36-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-37-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-38-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-39-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-40-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-41-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-42-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-43-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-44-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-45-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-46-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-47-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-48-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-49-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-50-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-51-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-52-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-53-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-54-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-55-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-56-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-57-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-58-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-59-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-60-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2428-61-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB