59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Submit
Reports

Overview

overview

Static

static

0323b4326b...02.exe

windows7-x64

0323b4326b...02.exe

windows10-2004-x64

0898a80dc2...92.exe

windows7-x64

0898a80dc2...92.exe

windows10-2004-x64

0aaecf7f77...91.exe

windows7-x64

0aaecf7f77...91.exe

windows10-2004-x64

150e8ef3f1...02.exe

windows7-x64

150e8ef3f1...02.exe

windows10-2004-x64

23e95ba676...7f.exe

windows7-x64

23e95ba676...7f.exe

windows10-2004-x64

28e7dc4aeb...33.exe

windows7-x64

28e7dc4aeb...33.exe

windows10-2004-x64

350b0d6ae2...d7.exe

windows7-x64

350b0d6ae2...d7.exe

windows10-2004-x64

3a6ebac4f8...ca.exe

windows7-x64

3a6ebac4f8...ca.exe

windows10-2004-x64

3fe801df14...4f.exe

windows7-x64

3fe801df14...4f.exe

windows10-2004-x64

41367ad447...00.exe

windows7-x64

41367ad447...00.exe

windows10-2004-x64

48f4749f13...77.exe

windows7-x64

48f4749f13...77.exe

windows10-2004-x64

499d936c22...82.exe

windows7-x64

499d936c22...82.exe

windows10-2004-x64

4b5a6926ab...d1.exe

windows7-x64

4b5a6926ab...d1.exe

windows10-2004-x64

4bb0d8eb6b...81.exe

windows7-x64

4bb0d8eb6b...81.exe

windows10-2004-x64

5de3d5a337...ed.exe

windows7-x64

5de3d5a337...ed.exe

windows10-2004-x64

5e2b2fe65d...20.exe

windows7-x64

5e2b2fe65d...20.exe

windows10-2004-x64

Resubmissions

25-12-2024 03:42

25-12-2024 03:39

25-12-2024 03:37

25-12-2024 03:21

Analysis

max time kernel
93s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 03:39

Sharing

Copy URL

Twitter E-mail

Static task

static1

vmprotect upx

3 signatures

Behavioral task

behavioral1

Sample

0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Resource

win7-20240903-en

ryuk credential_access discovery ransomware stealer

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware spyware stealer

windows10-2004-x64

18 signatures

150 seconds

Behavioral task

behavioral3

Sample

0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe

Resource

win7-20240903-en

ryuk credential_access discovery ransomware stealer

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral4

Sample

0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware spyware stealer

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral5

Sample

0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe

Resource

win7-20241010-en

ryuk discovery ransomware

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral6

Sample

0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware stealer

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral7

Sample

150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe

Resource

win7-20241023-en

ryuk credential_access discovery ransomware stealer

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral10

Sample

23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware spyware stealer

windows10-2004-x64

18 signatures

150 seconds

Behavioral task

behavioral11

Sample

28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Resource

win7-20240708-en

ryuk defense_evasion discovery execution impact persistence ransomware spyware stealer vmprotect

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral12

Sample

28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Resource

win10v2004-20241007-en

ryuk discovery persistence ransomware vmprotect

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral13

Sample

350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe

Resource

win7-20241010-en

ryuk credential_access discovery ransomware stealer

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral16

Sample

3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware stealer

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral17

Sample

3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe

Resource

win7-20240708-en

ryuk credential_access dave discovery ransomware stealer

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral18

Sample

3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe

Resource

win10v2004-20241007-en

ryuk dave discovery ransomware

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral19

Sample

41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe

Resource

win7-20240903-en

ryuk credential_access discovery ransomware stealer

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral20

Sample

41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware spyware stealer

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral21

Sample

48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe

Resource

win7-20240729-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe

Resource

win7-20241023-en

ryuk credential_access discovery ransomware stealer

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral24

Sample

499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware spyware stealer

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral25

Sample

4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral27

Sample

4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Resource

win7-20240903-en

ryuk defense_evasion discovery execution impact persistence ransomware spyware stealer

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral28

Sample

4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Resource

win10v2004-20241007-en

ryuk discovery persistence ransomware

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral29

Sample

5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe

Resource

win7-20241010-en

ryuk discovery ransomware

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral30

Sample

5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe

Resource

win10v2004-20241007-en

ryuk credential_access discovery ransomware spyware stealer

windows10-2004-x64

19 signatures

150 seconds

Behavioral task

behavioral31

Sample

5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe

Resource

win7-20240729-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Size

353KB
MD5

2d438f5ca86f9813dd17346c8865bd4d
SHA1

65b2e9be5770e294bed07fa9b5ecfdadb94203c3
SHA256

350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7
SHA512

dd979e28370fbb5606cdcd14c0ded0be1a8e6cbd98d8ae57d4e1c97ef47e0b2387462b66914cf600d3a93dfdb794addc4b29d7ff40948a761a968d3527e4db3c
SSDEEP

6144:OxN7NO77pzXFZ2m9TqbwWMIyBkq+OF3B:ON7U777Zwb7MIyW4j

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe

Processes

C:\Users\Admin\AppData\Local\Temp\350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
"C:\Users\Admin\AppData\Local\Temp\350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads