cfd3c6ab6b0694c9d9c96f9b50702beb5dfafce61fd0509d4e4ceab98777a4d9

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfd3c6ab6b0694c9d9c96f9b50702beb5dfafce61fd0509d4e4ceab98777a4d9.exe
Size

712KB
MD5

52dc8b670b559c7664525e06ffcbb75a
SHA1

7dee9f62487dc38914ae7ece6f8a78cb630ffd36
SHA256

cfd3c6ab6b0694c9d9c96f9b50702beb5dfafce61fd0509d4e4ceab98777a4d9
SHA512

ee2e850d51e4cb58e4d0c9d07fd4c867440d3eec5b19d5804604365ca95a431409c162ac131e4640b801654df9a1ad3de89f96dcaf7c270831c1a6ca9442f6c0
SSDEEP

12288:8Ea1wj+DFVSTRZQUFLlo80Q9gAS8UNdpy4l0DOlLZMc1iMRX1K+AGiBlKWpjsezq:Nao+xVeRXllhD928UNdw4l0DOlLZMc1H

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfd3c6ab6b0694c9d9c96f9b50702beb5dfafce61fd0509d4e4ceab98777a4d9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2116	cfd3c6ab6b0694c9d9c96f9b50702beb5dfafce61fd0509d4e4ceab98777a4d9.exe
2116	cfd3c6ab6b0694c9d9c96f9b50702beb5dfafce61fd0509d4e4ceab98777a4d9.exe

C:\Users\Admin\AppData\Local\Temp\cfd3c6ab6b0694c9d9c96f9b50702beb5dfafce61fd0509d4e4ceab98777a4d9.exe
"C:\Users\Admin\AppData\Local\Temp\cfd3c6ab6b0694c9d9c96f9b50702beb5dfafce61fd0509d4e4ceab98777a4d9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\CPUID_INFO.ini

Filesize
207B

MD5
d93605827d8c10e0623e6ac13df29553

SHA1
6ef456c26c60e2df1e0c483b373444a4dc5a8c6c

SHA256
7ad2c763cc78b9b1db33c6121625575619eabe7f302b08999f13867ff7395524

SHA512
19c7f96b84eb59bb4a69e7cfaf906a3ea6f3be71e2b39511191b40ef68746fca4b35cc45777d37b16fc80f913bbbab3f379bee63eb64e081d65f6ab66f1920e9

Download Submit