Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2024 05:01
Static task
static1
Behavioral task
behavioral1
Sample
050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe
Resource
win10v2004-20240730-en
General
-
Target
050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe
-
Size
8.6MB
-
MD5
2ed219ec34fc841af2382cdf119fe756
-
SHA1
ed46c951257b91cdf32a17dc9bae66ce08c8ae79
-
SHA256
050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90
-
SHA512
962770e9d676a8302e0062e11e2907169d4bcd6d284040bc94e1fae1d6f59ca95881f2974bbb765c3dd2d456967758608638484e61a993b0a5144f9b38551e80
-
SSDEEP
196608:R83R4hCkeQOQu3l4du81bCgsOq92j9CMamrsN7iPN9KlMPG/KZbtLt:RA4hHXg4duWuLOol807i19Kyf
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe 1556 050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe"C:\Users\Admin\AppData\Local\Temp\050f66976f940c339f96aebad219db0cedce4563c0946330b8decde2fc28fb90.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1556