7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe
Size

10.9MB
MD5

271849a38e2874e9e4952daca0163d3b
SHA1

92d72d52d1b2bfd0bd159c88ebb5234358cad496
SHA256

7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8
SHA512

959fa97702b560b3cf911d33c5b0b727010870db73080b924ebe9cde7dedea40814fde56c5a2b786acd68b8c5a5c92047181d29b180f2c0d6df9c0a6e8b8916b
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2780	7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe
2780	7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2780	7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe

C:\Users\Admin\AppData\Local\Temp\7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe
"C:\Users\Admin\AppData\Local\Temp\7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
225d7b82d463d60454122e75c52c0318

SHA1
daced39648edbc52263870a08cea8318d3924034

SHA256
cc8717099f6d6d17e2000a60073395649f4ead2a3f4d8c5d9883638121bfcd70

SHA512
611df49ab34e8059118527e531743e8787a75a6202b42b5ea53b6d274e5c984be86b70eda7f7318bd21c9b0a5a9e7c8ab729799d5d3d372a228a4fe846837cef

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
8c5ff9e73a9c80edc1b7a8b4b7ba9a62

SHA1
81455f1214e803bd5fd103f63ccc5a83d5660436

SHA256
735e8d22f5e2c2ab90b63379b4944948e11fd77caa521c85e6e7634389d7661b

SHA512
c483d481b7504a70cd2f3ccbbef924edd03cf98a92d5825f07f131228e2a6e412421a73ea475c295a13d09416ac14a4675eebe7c49c87d2a112beb0bbb850e33

Download Submit