54acad0b64e41a74ebd0320d1045d28d7eb39f1efd3fd0d9927060bc2f94ee84

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54acad0b64e41a74ebd0320d1045d28d7eb39f1efd3fd0d9927060bc2f94ee84.exe
Size

3.1MB
MD5

3bb74342c7690774305d4d45e01b2e5d
SHA1

a10ecb252c269209edb7495fa906b0e52e217d37
SHA256

54acad0b64e41a74ebd0320d1045d28d7eb39f1efd3fd0d9927060bc2f94ee84
SHA512

641edd9af9c4877f45cc5126b639845bce501fbf4907d81685ebdbb8086ee900d70c8fc62ae83df21cb99c70690d9c5acc74045dad6831b622753475767ac8d5
SSDEEP

49152:mVAbwUJqsNL8BVGwpFVAsHMCL2VYDY1iSWf/E3/gWi7+pIT0i6gIpOcbbNyWT:iARdO1zV9MCyV60af/E38ovgIEfS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2780	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54acad0b64e41a74ebd0320d1045d28d7eb39f1efd3fd0d9927060bc2f94ee84.exe

C:\Users\Admin\AppData\Local\Temp\54acad0b64e41a74ebd0320d1045d28d7eb39f1efd3fd0d9927060bc2f94ee84.exe
"C:\Users\Admin\AppData\Local\Temp\54acad0b64e41a74ebd0320d1045d28d7eb39f1efd3fd0d9927060bc2f94ee84.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2704
- C:\Users\Admin\AppData\Local\Temp\7zS09A2C367\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7zS09A2C367\setup.exe
  2⤵
  - Executes dropped EXE
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS09A2C367\setup.exe

Filesize
6.4MB

MD5
d5a8c7674ef563adf4098e1f8d4e15c7

SHA1
57544807962d038d01db8c75798db22d0a21a6c2

SHA256
b194316eebbf22f3afcbb1d4f153a3e1ead8d961adfe6bf9c3dc16f8c735635d

SHA512
1f8266e0d2b1f00ba901384975c9bf2d00ca7cdb42af7590b489110949a0fa07cea521bba24dc9ce72b22377203ee204a6ea9633bb58992d0e19f33fe85ad2c9

Download Submit