82eb79be72c4c652c2c67dec9915f4852588d240d48b415c9e4981c35647597a

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82eb79be72c4c652c2c67dec9915f4852588d240d48b415c9e4981c35647597a.exe
Size

10.9MB
MD5

133f84b6bfd900cd958fcb80bc881013
SHA1

ca287e211b1c677a80f2cd460cc147805cf4c90c
SHA256

82eb79be72c4c652c2c67dec9915f4852588d240d48b415c9e4981c35647597a
SHA512

39805185b580d976c6cc6299ff518675c0bc72a70bf6d24a0772c8461890067b6ff36f0f71b819b4b9b8a7ccc704ec44f058b33066e8c799ba8fa21d6128d504
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82eb79be72c4c652c2c67dec9915f4852588d240d48b415c9e4981c35647597a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2352	82eb79be72c4c652c2c67dec9915f4852588d240d48b415c9e4981c35647597a.exe

C:\Users\Admin\AppData\Local\Temp\82eb79be72c4c652c2c67dec9915f4852588d240d48b415c9e4981c35647597a.exe
"C:\Users\Admin\AppData\Local\Temp\82eb79be72c4c652c2c67dec9915f4852588d240d48b415c9e4981c35647597a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
3KB

MD5
c149a121f8760f1818b9bf2b416aa789

SHA1
1bbf8727e0d8ec0b90e4701f3ff3a3d467757acb

SHA256
42b7d390fc674d6039a2d66d941fd157cf6a65cd4e0c9c4f818816b14954bb3e

SHA512
f50d6cffd63ae88bb57da8474740443e4aa54cf09fd88abb9f56e813e808a5e9320a35d575294596dce513170cfc4b4dffb98926f17e7f9aeb1adbc8f14da070

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
3cc8df18cf34e28090c73d91c96283f0

SHA1
8bc7301d1e1d259a67d9695b01a35dada1a754ce

SHA256
880cc52635f93e85dec57e6307a00d5c6ccf8e10ebe248507b3afd9a88f2eb21

SHA512
1a44feca0cd3378fb7f3f46e95aa3340c4e67dc6e911609f54669021aa7e7141b4214cb3f82d03fe139c23ef0f15a87f0f95facee80ef46d226123ea686313bc

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
78cc64456050e545aa752153c991200a

SHA1
41bfd0055f95011260ab20e6f567484f35f712a6

SHA256
dbcbd46ebc0b9fa0acaf4f5c9beefa73c38ef222cc99e9bf2a228e7a48abf194

SHA512
a0f1d8de7daa44ef8d0747a7cef5eba2c62f373a434350a5305ba388dd5320f52f9ad3e01df0b1b9fcf9fad5bfb34b80fd2448983a4d32709bb5ba3c3cee456f

Download Submit