f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe
Size

10.9MB
MD5

a9b5ac731ae086ca2ade5f0a4e2eed2d
SHA1

1fef58ae3ae4801a3b4feb0e7403c7df7f6c0aa3
SHA256

f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445
SHA512

972c7291070d7cb9ce29d1304bda1e66ed9e21b34b0062d0431f664f0f3d94ae7b66cb3349ed30d2e0c597755c61d902d2d163c45161edc0f3f54e5d64f9b5ec
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2696	f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe
2696	f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2696	f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe

C:\Users\Admin\AppData\Local\Temp\f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe
"C:\Users\Admin\AppData\Local\Temp\f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
d26fb7b480f0a51de5cae426f5f1befe

SHA1
bc16376ff5d66dfd5c7bc4fdfb2c942e79685601

SHA256
1fd7a8382b585984dc4da147bd504d6034a9417223b90579aebabff584a275d9

SHA512
a4122f7a2fe47521faf7e7f2e72d65bc359eca4329e699af731d976dedee0e9406f0b66b37cf53f83746f00619829a3e29dfe1eb35403943b1b3507b05ac5632

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
6b60e9b7138338d5d9da3517b37056b8

SHA1
ab5e0b862f32a606e6db60f7759b64c8892348c3

SHA256
4f7ecbec40fc94017caccd00aa704206b2d447f3926bc644988bf77f3d1c0b6a

SHA512
298d7e47764fb0df6234ec4aadcb0216e35f6084535321dbc378ce873966f02f092865c1f031da4c11b04563c18e2783e78a5a0642fe615d7bd64baf17e0d83a

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
15e8534d2986a4aacfbf04f42435bbd0

SHA1
b08c3d8975e97f37d8ccb3330281fdff3a6316c7

SHA256
38f384af21de8c3e565a265386e35221a4d2f72119c02b1a17837d9a03f75f7b

SHA512
74875778f6f8aeffdccd94c7138b84eea983763b3ec8ab908ed7ab798458827066e6de98230af53f8dfbc1fb87c8fdac88af4b49d2a2e0f5319205cd27e361c6

Download Submit