Overview
overview
10Static
static
3Config/cy.vbs
windows7-x64
1Config/cy.vbs
windows10-2004-x64
1Config/fold.vbs
windows7-x64
1Config/fold.vbs
windows10-2004-x64
1Data/libifcoremd.dll
windows7-x64
1Data/libifcoremd.dll
windows10-2004-x64
1Data/msdia100.dll
windows7-x64
7Data/msdia100.dll
windows10-2004-x64
7Data/mysql...ors.js
windows7-x64
3Data/mysql...ors.js
windows10-2004-x64
3MigrationS...cs.dll
windows7-x64
1MigrationS...cs.dll
windows10-2004-x64
1MigrationS...es.dll
windows7-x64
1MigrationS...es.dll
windows10-2004-x64
1MigrationS...st.exe
windows7-x64
1MigrationS...st.exe
windows10-2004-x64
1MigrationS...p2.exe
windows7-x64
1MigrationS...p2.exe
windows10-2004-x64
1MigrationS...ct.exe
windows7-x64
1MigrationS...ct.exe
windows10-2004-x64
1MigrationS...st.exe
windows7-x64
1MigrationS...st.exe
windows10-2004-x64
1Rapid/Refl...001.js
windows7-x64
3Rapid/Refl...001.js
windows10-2004-x64
3Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
3libcrypto-3.dll
windows7-x64
3libcrypto-3.dll
windows10-2004-x64
3libssl-3.dll
windows7-x64
3libssl-3.dll
windows10-2004-x64
3swscale-6.dll
windows7-x64
1swscale-6.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 05:32
Static task
static1
Behavioral task
behavioral1
Sample
Config/cy.vbs
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Config/cy.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Config/fold.vbs
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Config/fold.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Data/libifcoremd.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Data/libifcoremd.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Data/msdia100.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Data/msdia100.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Data/mysqli_query_iterators.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Data/mysqli_query_iterators.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
MigrationService/System.Security.Cryptography.Pkcs.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
MigrationService/System.Security.Cryptography.Pkcs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
MigrationService/VBoxRes.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
MigrationService/VBoxRes.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
MigrationService/helper/bin/ahost.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
MigrationService/helper/bin/ahost.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
MigrationService/helper/bin/bzip2.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
MigrationService/helper/bin/bzip2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
MigrationService/helper/bin/connect.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
MigrationService/helper/bin/connect.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
MigrationService/helper/bin/trust.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
MigrationService/helper/bin/trust.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Rapid/ReflectionType_001.js
Resource
win7-20241023-en
Behavioral task
behavioral24
Sample
Rapid/ReflectionType_001.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Setup.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
Setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
libcrypto-3.dll
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
libcrypto-3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
libssl-3.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
libssl-3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
swscale-6.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
swscale-6.dll
Resource
win10v2004-20241007-en
General
-
Target
Setup.exe
-
Size
72.9MB
-
MD5
2f30fcf726e3fcdcbdaec184de4eef49
-
SHA1
eb903c0ac418fcaa95838de2687734192362e7f0
-
SHA256
7550080fc9af42e81213c822f1279e641ed7bc95b801d5d0c933d069fb501e5c
-
SHA512
67de50ae4acb7911fb64965a12e300998662d9c619ca9a957cec4e3fedb5c67071b9363f2d0fd8e7e3c0e3e3aba6675d065fc36f5c440885bb890a794c66e6da
-
SSDEEP
49152:Cg2qPtc1e5OS7bPGoUl+x/grNPazvchYk2pq4:CvqPCnrNPazvSYI4
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3840 Setup.exe 3840 Setup.exe