0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505.exe
Size

2.1MB
MD5

128992982396d23ce40ac8180e1b8293
SHA1

54916d4fb9eb5930012186b480bcc64701d7f5b8
SHA256

0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505
SHA512

91d944303390f91bbdbc122325cfe20dd7a0ef17a4bcaa0a9382297d0cb4ddc42c718dda03d78b6d70a50e1614af3ae09c6c8dd559140d8f6b86e5eff2ee6c1d
SSDEEP

49152:i0Ytt4O68enHUJY16MQyTCbFHDAHqEoqPUH8:7fwMQBWKEVUc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505.exe

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\sShortDate = "yyyy-MM-dd"	0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\iDate = "2"	0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\sDate = "-"	0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2232	0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505.exe
2232	0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505.exe

C:\Users\Admin\AppData\Local\Temp\0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505.exe
"C:\Users\Admin\AppData\Local\Temp\0b8fecb0474a8e1a211dbc1069cb6e40ce3c742c539fa60a4273b0edc9020505.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-0-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/2232-1-0x0000000077BC0000-0x0000000077BC1000-memory.dmp

Filesize
4KB

Download
memory/2232-2-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/2232-3-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/2232-5-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/2232-4-0x0000000004850000-0x00000000048AF000-memory.dmp

Filesize
380KB

Download