d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254

Analysis

max time kernel
135s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe
Size

10.9MB
MD5

bb7944196510ee90e19bd44b636d5d4b
SHA1

ff5e01b787a8a6e4dbe57ebe816f2cf6719cd3da
SHA256

d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254
SHA512

91976ad15f0f9d89aa93553e3146043c621404bd61e1481889b17d4ba2129ed3c2f1fb13e9c9b8b47e90b0d9b74d11fe5ffb6fc7008836a9b552996e0ca61e7e
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3700	d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe

C:\Users\Admin\AppData\Local\Temp\d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe
"C:\Users\Admin\AppData\Local\Temp\d9e318b2c53e6c08f6abf445369fb9e0ae482014ebc73ce0e5bea939e6436254.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2152,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
6f58c2891f638712a54e573f30131940

SHA1
2d4a784850b652caa27d852eb6f1f631fbb6b1eb

SHA256
433bbeaba4e000e3e0800a7025d92bf3f2703b4f076971ce82fdc19522b560f9

SHA512
454bc7a7614fbc59677e81463033b395e68476a920429d77c8a8a3f30513a8da9dca6e9da49bd570ed91210bcda5b9b5f8d7b2c9173eb638c88048102903a24e

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
8KB

MD5
af6f35cf0a7e4a44d5976c861578826b

SHA1
b605c9f53d24914c4eb57ea808f68b5b201be99f

SHA256
95bd7f0947d688290a8298234522f86243da8f702025ca5f58c190ff2f6dbccb

SHA512
84fd190148095196134df15859e0a6fce3a3d5f509a7df6f42a6d85f7a3b79f6fdfaa1eb5450ace529c53a420a31d805d25e0345ad5c602eb0e009527fb52a23

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
2a766c5deb5c570732c961dff1bca63d

SHA1
0677038160f513472d55db9573c7023c03945856

SHA256
7155f6fe5ef380b3abdea9d88697c8674975b228b69e264a7a2388069d052e1b

SHA512
3112da2bd75dd2807c236e451fc319fe27dcd790758d0190c13518795860db7c0c22e825fba661ac4dc41d48b81c838aedb04bfe8583479cb1be9c723a603109

Download Submit