c8eff05ddf176ea6b12f5e973263f9eb2c5961300312873d328a18eb8995b504

Analysis

max time kernel
133s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinTool.exe
Size

48KB
MD5

9cc9a18f4f0ca6d8fbdbb8d5410f303b
SHA1

69ab499110d32112c15c5cb599fb31f21eb331d5
SHA256

14f68999325122f5fdeaba0c23a94eee68db9c462b6101acc1ffdcce308987dc
SHA512

b0f0f6b31954baf9baef2dc8f7b08daa9dc63a63853763b3576fb87eb3cb675e354e0257344b9532037b50569a696c76fe55c59e0df469b97189232d79c33567
SSDEEP

768:NL6mRbLCM3i4j5mugDohINhEInk5zcBmcLQxPTkfyPJv9:NL6WLCM3Z5mugDohIhtk5zcBPL1OJF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinTool.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3312	WinTool.exe
3312	WinTool.exe

C:\Users\Admin\AppData\Local\Temp\WinTool.exe
"C:\Users\Admin\AppData\Local\Temp\WinTool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads