ba43fc01fad8267708cc7f8405e08970724c198bf47354c0d9706d3c57a2482c

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba43fc01fad8267708cc7f8405e08970724c198bf47354c0d9706d3c57a2482c.exe
Size

7.6MB
MD5

b66774408494181c3180963e95b48404
SHA1

51ad154ad4ae223fde69a2c45f3d5b007dfce6ee
SHA256

ba43fc01fad8267708cc7f8405e08970724c198bf47354c0d9706d3c57a2482c
SHA512

b260873a639d9ca443d3e78f3f056f28b97cc76626214e3120ae724eb07507d90025a65bd8c919655e8581c9a96098cfb4b31f7befdcf8b502aa6e992fcfb35c
SSDEEP

98304:bP5mq4RW60WR+Qrvg7D1GYOh8NbFPAQwDfWw08dGODav43c9N6:b6R187D1GYOeNlA7W38NDaW8N6

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba43fc01fad8267708cc7f8405e08970724c198bf47354c0d9706d3c57a2482c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
448	ba43fc01fad8267708cc7f8405e08970724c198bf47354c0d9706d3c57a2482c.exe

C:\Users\Admin\AppData\Local\Temp\ba43fc01fad8267708cc7f8405e08970724c198bf47354c0d9706d3c57a2482c.exe
"C:\Users\Admin\AppData\Local\Temp\ba43fc01fad8267708cc7f8405e08970724c198bf47354c0d9706d3c57a2482c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
c57b7506087a579c4756890475a2c673

SHA1
d84255fc9957aa5e485bca8cfef9c1dd4a76dd3c

SHA256
3be4ddc0b3ad7e56f91ee4a17b6710eff7841085f9d8fa2713f6a0f471ca2d12

SHA512
2a33c953fdb05b162981ef5707a4e7ef8cfc9c4208a234439f7251298cc2e280416f6f0d049d416a8c6388a219679e115b4dec21eb8830de30c2c244ddb02661

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
51827ef47b1b65bbd06c0c1869b46c78

SHA1
49ed0a53ebf646cd1209d1ebd48cf614b48b181d

SHA256
88965d6fd38916b672f37ed24fce4f402d9261465800ac4741b3114219e31dfa

SHA512
6a647c82c204e7c60d92c9a022426b26b2037f6b33cb78275065a3e4a89ef861dd7af05bfb18163e7b4a5fb48fcdc6b25ea491ddd8f156b54b3fe9b2a613619e

Download Submit