0c0750129ac77a52d2adecd864cf370741462a50ee6e3fb4acef693a91c8d834

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c0750129ac77a52d2adecd864cf370741462a50ee6e3fb4acef693a91c8d834.exe
Size

9.9MB
MD5

cdaaa3c8a5328758a9545143f9909884
SHA1

4e7c409b3e998dcd9343015a355a301fbb102e05
SHA256

0c0750129ac77a52d2adecd864cf370741462a50ee6e3fb4acef693a91c8d834
SHA512

52a6523572e40ddc5edc533be57aca85cefbf29b6a12ceeb6685c3fe6669f76f93cbe9cfa6ff640b256a21e8660865c1f069ccd93f9356e291210197dea9dcf4
SSDEEP

196608:yvS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:yvRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c0750129ac77a52d2adecd864cf370741462a50ee6e3fb4acef693a91c8d834.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1116	0c0750129ac77a52d2adecd864cf370741462a50ee6e3fb4acef693a91c8d834.exe

C:\Users\Admin\AppData\Local\Temp\0c0750129ac77a52d2adecd864cf370741462a50ee6e3fb4acef693a91c8d834.exe
"C:\Users\Admin\AppData\Local\Temp\0c0750129ac77a52d2adecd864cf370741462a50ee6e3fb4acef693a91c8d834.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
d5f1a035e53f433e54a775f1a2af736f

SHA1
1ddf2f18f0891bc2d0da4587ba8b9c32cc97b13a

SHA256
1b1e5e91d7357b90eb0213813c2912efa3fbb0778e34559b5ce3dfa4f8c86fbb

SHA512
8b77851d1111342ad63855b9ffe554d8c715840790b504f1d47601bd7f4029f19fa1bc4f9a97fdb2729df0c30e32af4729249f12f683f97e8e8d38ac68c8a835

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
61c17593c5e05b959545c3cd30fa021d

SHA1
af5fc876a448d18b7091a1a90d3b8589c1e9600c

SHA256
c9593f5bd22ea9e6fa700a5842162443cbe29f557a61b10de9039ccbac3cdfb3

SHA512
dea5276609f1af234f534a416ea3abd12a8dd1869ac5db11dc9bd3aab776f2e2bd0f6789d39344d16ee35af89f3a2aff12a2dcb1c7e06d940329c2ba37e26186

Download Submit