2c395853a1e120c135facd0f10972477f076432ac78f5fa021cc39cd44882220

Analysis

max time kernel
94s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c395853a1e120c135facd0f10972477f076432ac78f5fa021cc39cd44882220.exe
Size

10.8MB
MD5

28f2c148f65c833e9bc32a0c6f964687
SHA1

65acc0e49996d2787a12ad16532305f975592ee6
SHA256

2c395853a1e120c135facd0f10972477f076432ac78f5fa021cc39cd44882220
SHA512

6d00a068af3c326ebd6740b0223a2ed81e3ba1efad4d26d8fc64b122799a020be081abe258a61b1e0a5a0f55a7a1929d7c88c79d5c070b5fe114b33b655f6dd8
SSDEEP

196608:6qGPhSSJ7PbDdh0HtQba8z1sjzkAilU4I4:6n5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c395853a1e120c135facd0f10972477f076432ac78f5fa021cc39cd44882220.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4080	2c395853a1e120c135facd0f10972477f076432ac78f5fa021cc39cd44882220.exe

C:\Users\Admin\AppData\Local\Temp\2c395853a1e120c135facd0f10972477f076432ac78f5fa021cc39cd44882220.exe
"C:\Users\Admin\AppData\Local\Temp\2c395853a1e120c135facd0f10972477f076432ac78f5fa021cc39cd44882220.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
176dfa655d70fbb5a3840195c8128ecb

SHA1
9694e32e8fd06ca7931a7f5c15989d127cb505fd

SHA256
c173b2d12efdc0767773a672a059d8a06edd21ec3aae53f572eac64966483f4d

SHA512
6890ae9206e90b399bec07d23eeecadff830ea02fa5bb14f8bd0ed7194936ece29be326551389457b82a8be66bc4dd382481944161253a6042bf679a384239ef

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
97dc9e514e8b15cb308251f92ab5064e

SHA1
4035593db26b0d336261f45ef7d06a8b72a7fd2e

SHA256
d66c846a09abb51ca597f5b8ffb6b82e03937b9cb2f1457749b648e6b2d720b9

SHA512
0db8e05983f2922ab58992d32313537298f912690fdae21c9e18ec6343d750780e8a1b10fbee6719fb1456c59f877b2e13ef79fce63144d99dd6beb48366f472

Download Submit