f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe
Size

10.9MB
MD5

a9b5ac731ae086ca2ade5f0a4e2eed2d
SHA1

1fef58ae3ae4801a3b4feb0e7403c7df7f6c0aa3
SHA256

f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445
SHA512

972c7291070d7cb9ce29d1304bda1e66ed9e21b34b0062d0431f664f0f3d94ae7b66cb3349ed30d2e0c597755c61d902d2d163c45161edc0f3f54e5d64f9b5ec
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3344	f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe

C:\Users\Admin\AppData\Local\Temp\f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe
"C:\Users\Admin\AppData\Local\Temp\f7e9d44ab453b876cb0cca05d2ae3c68f9379163dd39d869dc9fdd4028ec7445.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
a0d273136eef71e9069decea8d877f74

SHA1
57d2fa36aeb05e2b4fd623537249078b288990e4

SHA256
7f609865cc88b93a7bab69c325403000ff042b845575db6ecd9b1128d16a2683

SHA512
630b6251c77620034fcc2ade39354bf78058ced39ffbb219e35287ec0451ae0a3d16bcd3deebe4992ef7a5f8b033ba3b454974627d63969c81978f54dee834a8

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
0cf9ea7df4204508fb5c40eaf3bb0c7f

SHA1
05ef57ecb915182f400378d2dce91848dd999623

SHA256
ff0928117bc7ca2c6c6e8582da8695ce4bd95973d5118a8748b65c3e11749298

SHA512
2065e94c4e6bec17a430338470a49408850e76b6ae298a46fe57ede3945b4e16ada2084c1741e6993974c6127916da81adabdce7b2a4263941d4a0508ae000b9

Download Submit