7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8

Analysis

max time kernel
144s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe
Size

10.9MB
MD5

271849a38e2874e9e4952daca0163d3b
SHA1

92d72d52d1b2bfd0bd159c88ebb5234358cad496
SHA256

7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8
SHA512

959fa97702b560b3cf911d33c5b0b727010870db73080b924ebe9cde7dedea40814fde56c5a2b786acd68b8c5a5c92047181d29b180f2c0d6df9c0a6e8b8916b
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3384	7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe

C:\Users\Admin\AppData\Local\Temp\7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe
"C:\Users\Admin\AppData\Local\Temp\7e9ce23d10627a67de4964c526f5415e64a9293b2dca434b83b980c7fb191ee8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
8c7537eb165e6cad2943aebbba816a5d

SHA1
1d65746e96bcdc437ba4cfd34b23560823bca640

SHA256
eb5526724663668e75c9c23dc70e3c40b7969625860bdcbd7c4e895145fa082a

SHA512
3e2f6b39af3e930aa697af58d48f6fe43062175b10a5a5ded2b53431f19103d4c13b415f7c9713c7543a0e604e858bebba2e3361a2fa626c0a8e6169941dea7a

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
fbf0fd002617c0d643226732aae1a121

SHA1
70ada62fea281e7992b646b85251daf389a7bba9

SHA256
18ab9ccc78ad8407fcb32cce7b4a79b94edf630b4127fe14a4cd572dc87ad27e

SHA512
2b83f708132419bb038d77bee00601450ada3d3b03dbaef59ffde14dadbc0c72a8aae4577e8809fa7d93db001196a3c02eeab0662ac958815596c96803756a9f

Download Submit