c7f56528cdf9b0c9a1ca5f114c48c3e5066d5aec11f92b836c2eb25d79851246

Analysis

max time kernel
142s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7f56528cdf9b0c9a1ca5f114c48c3e5066d5aec11f92b836c2eb25d79851246.exe
Size

10.9MB
MD5

8fdd67f6662ab6b494be94a7bd4b4125
SHA1

d1113fe106e5e1d380257beb4d32600b7b71d576
SHA256

c7f56528cdf9b0c9a1ca5f114c48c3e5066d5aec11f92b836c2eb25d79851246
SHA512

ec9f8711ac771ee83efd14d363b4e2d3ac0f1e56069b12d8c2280fd4f001c635e795e52d0cc2244a4f4286ce20f80056d6ac45deeb042155ded3a0a0c9494f62
SSDEEP

196608:ubGnWW5WySSJ7PbDdh0HtQba8z1sjzkAilU4I4:uKnW6Wy5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7f56528cdf9b0c9a1ca5f114c48c3e5066d5aec11f92b836c2eb25d79851246.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3468	c7f56528cdf9b0c9a1ca5f114c48c3e5066d5aec11f92b836c2eb25d79851246.exe

C:\Users\Admin\AppData\Local\Temp\c7f56528cdf9b0c9a1ca5f114c48c3e5066d5aec11f92b836c2eb25d79851246.exe
"C:\Users\Admin\AppData\Local\Temp\c7f56528cdf9b0c9a1ca5f114c48c3e5066d5aec11f92b836c2eb25d79851246.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4180,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
1802c0ef7fe8630fa4098db23b300859

SHA1
9e89c37a0fab51ff76a1707af076271c47cd481a

SHA256
1776789a075c6523d10278b7c783adffeef82403830bed0a020142f756a22de0

SHA512
d219e6e968f707cc71020f96a34634e52d6d30f864d945f41387472c1bab89ecde4954c5578360f854eac55d612a405cf765a189478c992f76237c08b9b6202c

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
3068aefea8d33363ca5a9ccb9c87eb6a

SHA1
f6a0b44a631f5e6d0d123b5977c12dab619b6524

SHA256
631398d6da3ae091f3faf026d522ac8ccfebda79a2b06489373ff7c9217fa3e3

SHA512
ddc40231ce1c63fefef674f130e0c0d476eef4bc42f62a52325e07bd5a013862342082adf4c0fcc1d8934bd616bd8f2c840dfe32f917f0342f2eaff6a2c43d04

Download Submit