93a8d2baaaaa7c1e2bd9a73fa37b14be0573d989e9e5a6ac972d9b2b96c84521

Analysis

max time kernel
117s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c839d0c3b427c7a1f67149351392790N.exe
Size 5.4MB
Sample240911-mtc7hawapl
SHA256 93a8d2baaaaa7c1e2bd9a73fa37b14be0573d989e9e5a6ac972d9b2b96c84521
MD5 1c839d0c3b427c7a1f67149351392790
SHA1 6cb4f3bbf579c33b026eeefc2b5da01e6b892ab4
SHA512 efe5c71e8b0c6fadf76387f6f9180f9aaa4590ff2f2c885314804029ed2a3ff66284b8c9444ac931942236e7a01fb2c12e3dda394eca04cf309dc531c8fa78b0
SSDEEP 98304:11f9b8DBaTb9QjSAwzEKfAdrHF1ZqLS5Cd/m37RQ8FLOAkGkzdnEVomFHKnPx:pb8LjL7qLS5G/Ye8FLOyomFHKnPx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c839d0c3b427c7a1f67149351392790N.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2552	1c839d0c3b427c7a1f67149351392790N.exe
2552	1c839d0c3b427c7a1f67149351392790N.exe

C:\Users\Admin\AppData\Local\Temp\1c839d0c3b427c7a1f67149351392790N.exe
"C:\Users\Admin\AppData\Local\Temp\1c839d0c3b427c7a1f67149351392790N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JiSu_installer.log

Path C:\Users\Admin\AppData\Local\Temp\JiSu_installer.log
Size 2KB
SHA256 69842946ff83fc0aa990752ca18f3fb6c1bfb5d04f5af665f778d2d968507dd1
MD5 5a8357c6525cee736d8aec61afeced4f
SHA1 4263355d32ddbb6cac780ac2ed8b98d51ac49c01
SHA512 65fb43666153bba42b82ebc866feb73e65cff67da6310f96e3435e9daa1e8a66285a65ba25960691c86d4cdb7c3e98e62765325f12946fdb5e4733c00d461fc4
MD5 SHA1 SHA512

Submit Download

JiSu_installer.log

Path C:\Users\Admin\AppData\Local\Temp\JiSu_installer.log
Size 4KB
SHA256 06dafc75c1193def80553ed12ef964ccb67073745c7d68d6ec0722ab2093cd3f
MD5 75be272ed8eee8b8aa68a77d7a9cb4d1
SHA1 1ad5193aedca6dafb4e6519e04bd6f5194ac2bc0
SHA512 b98b3f54fdb4021fdde0bfd2e1259ea0acbad0e86719df7c3ed51c5b5a9565df26affac37cdc264269ba79ac6c3c53297924db98d36aa9c4ad43f0c083c144af
SSDEEP 96:/uM1tXpQFjqdXizD5V75tXpY9mqd6/32NyVjuMniU3yk9uMF:H5iD57z
MD5 SHA1 SHA512 SSDEEP

Submit Download

JiSu_installer.log

Path C:\Users\Admin\AppData\Local\Temp\JiSu_installer.log
Size 684B
SHA256 4ab447731e7cadbdf68c9707fbb6d1c72f182ed1c74a68547059faa6dcc028df
MD5 baf961a66a2efda03563461696b9b21a
SHA1 cd6e0fde3de75fe240d2948c9e61004494efc5db
SHA512 e1b6315d9ca7976b52601aa73978d068a4f3661b9e1bb2c1651d96dc26f03a0efe27c92a4fe7e0b9d3fcd80041da68b22075be5be6993c9dea15b30b4148ee91
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads