6d7abd43e0f03e45e85e70997c26a0b82e4948c020028fbbc69ffdbb1a006726

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d7abd43e0f03e45e85e70997c26a0b82e4948c020028fbbc69ffdbb1a006726.exe
Size

10.9MB
MD5

1a5e8f2c466541344196487dc9cc990a
SHA1

8eb0a95b9ea32ac979d53a11cb418b8d4751f13d
SHA256

6d7abd43e0f03e45e85e70997c26a0b82e4948c020028fbbc69ffdbb1a006726
SHA512

a37d5dbc4264bd5f594cf3c482de54ba0d3e7d9398d2d4343c25ebe8b207c7c49635105c445428d6cd8b79d0426f02f8d826ea7908bb9fc4d4588a959ccbe1d2
SSDEEP

196608:FUWWPa65SSJ7PbDdh0HtQba8z1sjzkAilU4I4:FUWW5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d7abd43e0f03e45e85e70997c26a0b82e4948c020028fbbc69ffdbb1a006726.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
664	6d7abd43e0f03e45e85e70997c26a0b82e4948c020028fbbc69ffdbb1a006726.exe

C:\Users\Admin\AppData\Local\Temp\6d7abd43e0f03e45e85e70997c26a0b82e4948c020028fbbc69ffdbb1a006726.exe
"C:\Users\Admin\AppData\Local\Temp\6d7abd43e0f03e45e85e70997c26a0b82e4948c020028fbbc69ffdbb1a006726.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
7f1a294236db4b0e4947cd8fcf0da7d6

SHA1
5c32d5e4b2a9aabb78193a6960fd1cfd8e044256

SHA256
fb05d703a55bf384f09e968f80f1351bc50e0ebb67bbd8713069f68f31bc2089

SHA512
7193f6b62233835536b1f0075ee81d036cf34c04f299c2cfd7631cbc70b2c623375ebdc5e9fcee9af746074e941f7423714babb20e2be05964a109f4704068ee

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
33445f199e805eed23acf68ea54945fc

SHA1
3b61d5096efe0acd33b447bc60b9ae994e608ae2

SHA256
f000ef96c9fb1b33865ccbde4337b11ecd2e2c8d38bd3f3c9efb44e5ee16b474

SHA512
00f33f15f5ab54de5304b5ee296d3d0d00e83bb89deae49baa511ea369ec8d8059761e25cc2a56928a86af0ee3ca14e679fe31148f1effa99e290f80347e566a

Download Submit