a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe
Size

10.9MB
MD5

c9fe70ecd27b79785ec87dde2adcbd40
SHA1

69d5ea306257f0bf3359b6a2c1b6e1efb2a0865d
SHA256

a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e
SHA512

167a4c968831183fc071012e9c2a8d428e2296e0f66b7ea27c4a245ebb51d96e37f75120cd102999a3d4d75d358d9b549eaa9117fde835325fba6749c640ee9c
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2736	a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe
2736	a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2736	a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe

C:\Users\Admin\AppData\Local\Temp\a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe
"C:\Users\Admin\AppData\Local\Temp\a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
e4b9856689f21061f01b3df55f86e9f7

SHA1
020629577dfd82dcc21f1efc27ab8297891bb433

SHA256
fad56f7a890663908a7c73f53452039c50a17844d2e5d1ecc45a8380174d9477

SHA512
b7667690be2b01dd4d967320bb2f8cf418e51e696ef4fe683b46c812c02a88a982184ed969bb26c3b31fef208e445e7596c4ecd81c728685a5ef3c1a5901b4e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
e0c0a3b56b9c1a4a543d3c31ddda1c61

SHA1
1aa4c74246d6acf323815389a81fd1977745daaa

SHA256
a55a51bfd5b82059a17c57129ef9b75906258aca827fab964a3e93f6f6f7e9d0

SHA512
230f72a15c49152956ce56b7e639997c63e1c56d33e71a268cc34e7ce5f2aefc6de2d9e3448f3ef15cd75f1450e9d3b4d716233c6934ddc873469cc30c9591f2

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
58d37e98f5fd7b6e3c2afff9cbb02654

SHA1
d0dfc5fd2d49f23b14c0a5173da2ba71f87ff155

SHA256
d3c055e04e01cef428f9ab06b0ef77552c63c7f24ff1497e9f438f43e91fa82a

SHA512
9622e0dc0620d8c175c2057a66596541def932d0ab1d2aba99da2f41f5ebc0ba6d9716a27296c69112f487ac7ca7a4fa87a16375468da3bb3c6c1678525101e3

Download Submit