a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e

Analysis

max time kernel
113s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe
Size

10.9MB
MD5

c9fe70ecd27b79785ec87dde2adcbd40
SHA1

69d5ea306257f0bf3359b6a2c1b6e1efb2a0865d
SHA256

a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e
SHA512

167a4c968831183fc071012e9c2a8d428e2296e0f66b7ea27c4a245ebb51d96e37f75120cd102999a3d4d75d358d9b549eaa9117fde835325fba6749c640ee9c
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2496	a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe

C:\Users\Admin\AppData\Local\Temp\a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe
"C:\Users\Admin\AppData\Local\Temp\a45cc64e0a8ef83a6863f1a1a95b0456344626636a59994f926c5c89e7419c5e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
a3a2d0235a74c0dc5df72c12709c2f2c

SHA1
c9e8743ab48442c4b698b6d1608bc5dd29b44877

SHA256
373a30f9d27b806f67a0115bb6c41dde0c94337950c23a64a64e05a32dbca51b

SHA512
bfb73d47bb01580d74ced9dc019adacbe825a2d70bdf1dce0654fd2b3847ad159d1c8cf6e18edb59cebf1fd8117475d715e548aff6941699baaced865d1c0d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
8KB

MD5
3b3610bc46170ae1b3c470e18209468d

SHA1
2eb10ba9d3b0e2fefc8ef010df7840bb236abf84

SHA256
de7b76fa5ebbd75879086518f8cc467f1afae89b4e44b4a979c8feeb8a54abcb

SHA512
e362be69d63b936cb9a4334fce5454ca808f06df01b4638f1bbb01e391a12ea4c6745ae6490c5af23f5147303a24bac1fec53a8b2e3f968de8e46c4143b693b9

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
167bca7f26d7d713c7cc5081c19e7071

SHA1
18be5a3af654f172b7b7f4f4785a9737b9f0a50d

SHA256
103c287e3de71a6ca59fa6e5152cbebe48e22af6a4f0db54b57f4f300dc4bec0

SHA512
efacc1fc75771e463f2278812e9f940fb665ca760747e19e24a24f498f54d316b46ad1bcc0f8713eec4fccc413537c81fd986bde704764164e8adea9d001bbbd

Download Submit