95cf0d6fe912e401abf124ead106916528f1a0dd5eb5f7be42912d8ec1d975a7

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TKReplayPlayer.exe
Size

116KB
MD5

c13c3c2c39be5bdc5ef818cd4f2f6705
SHA1

e25c43ced8d685f24945314eae580d88594bca70
SHA256

4001c0094aac6c49d24dbe74e7484f2cb7e3ab6fa394342939526c4f91ce0c9d
SHA512

558128a9835a62e73e3827d3776226eab6eda7de7d2cca8744d497b2b7e2da2c8e897793e7483b0865cedbaa7260b1f79b787e6e1c4a48c573b83fde373f1ce8
SSDEEP

1536:yRFcn15W4s5jmzeV71DcZIgEXLjq+ibz70i7guGYq9MkHe0lBcoNYq:yb3J6eV75cZIg+m+iL7guDqnwoNYq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TKReplayPlayer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2004	TKReplayPlayer.exe
2004	TKReplayPlayer.exe

C:\Users\Admin\AppData\Local\Temp\TKReplayPlayer.exe
"C:\Users\Admin\AppData\Local\Temp\TKReplayPlayer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...