089acca8b4c292ed6291c7ebc2fe2a1f4528abb0201d8efaa243899499358735

Analysis

max time kernel
126s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

089acca8b4c292ed6291c7ebc2fe2a1f4528abb0201d8efaa243899499358735.exe
Size

10.9MB
MD5

83b5663fbb74f60bc3e4eb09bf1f3808
SHA1

c7eaf08ba1b7de2e0f94e119832721aa034fd03d
SHA256

089acca8b4c292ed6291c7ebc2fe2a1f4528abb0201d8efaa243899499358735
SHA512

5510dcaa660a1bf266d0b9a8f0f874c37fb172f8293e1db05fce0b7e7abe12f7c97ac5370072d0e9aa4b24b37ced467a4445491fad1465447e2a366c2def5e05
SSDEEP

196608:FzIsZwtDnJES0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:FzIsquRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	089acca8b4c292ed6291c7ebc2fe2a1f4528abb0201d8efaa243899499358735.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4256	089acca8b4c292ed6291c7ebc2fe2a1f4528abb0201d8efaa243899499358735.exe

C:\Users\Admin\AppData\Local\Temp\089acca8b4c292ed6291c7ebc2fe2a1f4528abb0201d8efaa243899499358735.exe
"C:\Users\Admin\AppData\Local\Temp\089acca8b4c292ed6291c7ebc2fe2a1f4528abb0201d8efaa243899499358735.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
3KB

MD5
13e635ec2eb36f898b671a06fa29ec62

SHA1
46263b9c2e98ced11d477ddfa36817bbd5efc72d

SHA256
78cd94ebbf18e4090ea5f8bb59ea5bed0331e78aa22e92463a719e1d1512383d

SHA512
e138a2d54043a858a4f355d686f850832efc91a7ba70f00cf41a40a3cd1fd2ff9f75e86088cc7f896583e2c6bd141588eb50a97ee6c2b2c2a858b9c3b3344bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
6KB

MD5
abd0daea4cbb289c2820b9df5087293f

SHA1
371f0357fce871c97fa0ea893b509b61860cccbc

SHA256
ec533b7238f5ff5dbe69eb9447369436d0c7a183124ebeed6472543e43fbdc3e

SHA512
83b07cd405b5160752b02efca1ec9069a981d2b6dcde7d16d795d1c142637abd86c562709bb893bf5d42b33ae8ad0b1270971da28841b496eb7629d458473a55

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
31b7927b3e236cb489eb0cabc9b2a3bd

SHA1
33358b625371c421591a5e2770e59788125a85b9

SHA256
36c723b16074ee253de0560529578a130c6eeeebc117e6bca3d7f2420e87186b

SHA512
3e2df7bee2ef0bb92d38bfa649fdbb8656ba02f6683e9aac81d79af0779241f3dd4cf7a57f430347d854e7078e828e36540a7817707c3a11fa394e04644a6b90

Download Submit