1934087948e7c56954803942c7d347d6ab49b806c24e49e800c462a79c37283a

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/haspdinst.exe
Size

14.5MB
MD5

0ad68bd38d3857e983ddf6487e2b8773
SHA1

8f364dfc45183f6cec8aed8915f27195023fdce8
SHA256

9da31fc1b33b2a39ad31a121acfe6671173023eb4cda7530486e452a299592c5
SHA512

29c04515dc068eee4ea8de6e26465ae61cdabfd7a0e5f8a27ae8fdac50332ab0e245877925e51ce2eb7a11d678375958ed95c9c85ed177504c5611b25d51b2d3
SSDEEP

196608:c0HwBjQ6NCI+0a+mKSbIIeJtkVlXS3ZASg1BgxtUGcs6VDVI/eVs3fKZ8SNjkDDn:cMwBkWahHITJyVxWxgbQbGXI9fKZ8P2

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

haspdinst.exe

pid process

4232 haspdinst.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

haspdinst.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language haspdinst.exe

pid	process
4232	haspdinst.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	haspdinst.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\haspdinst.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\haspdinst.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\haspds_windows.dll

Filesize
14.4MB

MD5
4faf3fcbdde33da789f28e9cc4827466

SHA1
ae606f6dce1fd0703b99aaf36bc949ac6acec35b

SHA256
8e50dc30c4cc28c6c411483a0760d546df8e8ba0c31b994306c1d71e9493413d

SHA512
8d91e7b33c871cf646de18ff0baad78342696ee4dd7d36804b5b3ef0cb915fc48a9d1debc93dba24a6431a47a216b348368675de5d25c250b201bf5be1cb9dbe

Download Submit