7495e33ff067ac77c4413931e0be35f042601b1eb4d356bdaeabf0d8127c6d14

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7495e33ff067ac77c4413931e0be35f042601b1eb4d356bdaeabf0d8127c6d14.exe
Size

10.9MB
MD5

2c2ca4140084b38764b549a69edcadd6
SHA1

c3123689d3796f55a3894aa98c8113305506d81d
SHA256

7495e33ff067ac77c4413931e0be35f042601b1eb4d356bdaeabf0d8127c6d14
SHA512

fe4ca4a4719c3a36490c724704b58ac6fc4fe3f64fbb9ec48d09f280297fab6617eeda730422438fc942c3682053851a3da20d29f46381328a570a6ded44d403
SSDEEP

196608:ubGnWW5WySSJ7PbDdh0HtQba8z1sjzkAilU4I4:uKnW6Wy5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7495e33ff067ac77c4413931e0be35f042601b1eb4d356bdaeabf0d8127c6d14.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2700	7495e33ff067ac77c4413931e0be35f042601b1eb4d356bdaeabf0d8127c6d14.exe

C:\Users\Admin\AppData\Local\Temp\7495e33ff067ac77c4413931e0be35f042601b1eb4d356bdaeabf0d8127c6d14.exe
"C:\Users\Admin\AppData\Local\Temp\7495e33ff067ac77c4413931e0be35f042601b1eb4d356bdaeabf0d8127c6d14.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
7230718503cc03d000344e7ad0a481c9

SHA1
18734981f72b5b46df49fe59dd9e35e5522f5129

SHA256
3a73758eabc0dc3f876f6315c269f9f15bd3ee1bef8c7f5e80ac29ee28b72504

SHA512
73d58f60bb786db484fecc1749c0fb64326f0716453a379a645bda7136cef60465265c39fc5c596c05bc48312b4b9cb53685c4549642437ede2d3a3b79da8cda

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
46af6dd7d540f34b25ddc327d640d52c

SHA1
0f28319aa60503b5b7dbab638a5d6747119ac8b4

SHA256
de0d2d3d607950a03151c79e3cc9436aa46aa0caf307e5c082fae89aae18b454

SHA512
c5e729964288aa10b651a336f01fa1c910b610799df35d1578c570990a459b532c708d440be2160e8fd796b7883d96f43142a575228240d81f7f4f9bdc1a7b2a

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
99ec2cc0edb459b2bdd5ed9b8a7e9d5d

SHA1
0755eec6a4ee46d95e911358aa9aaf74a894de63

SHA256
e980b1d828bf0f9a1bbe409f2d787c443d8c9cfe054a23ffd64dea50a85a78ef

SHA512
f98c9d115cd2b061d3caa7daccf180880e807497896314adadc72206e7bd0af8ea2209db95388ad083d80bfebd7f3fbce1f71f11e449ac1bddbe938cd765082e

Download Submit