1a0d2d51c5f7eeb506ff94979be30362ec20206fed1cca190a9bc8bd4a79486d

Analysis

max time kernel
94s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a0d2d51c5f7eeb506ff94979be30362ec20206fed1cca190a9bc8bd4a79486d.exe
Size

10.0MB
MD5

33411167b7becdd63b63b344f858a74a
SHA1

0a5afbc90628fa641e353d35e2a721e2c08101d1
SHA256

1a0d2d51c5f7eeb506ff94979be30362ec20206fed1cca190a9bc8bd4a79486d
SHA512

1d17be35c653437309cf8c973823d5865df0bd0ae370e6d873e47a2771e3ccf3efb3f0049c0a47d98a5b00424adb28aef5e29d9524309b193dae11901283e2d2
SSDEEP

196608:/lS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:/lRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a0d2d51c5f7eeb506ff94979be30362ec20206fed1cca190a9bc8bd4a79486d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4616	1a0d2d51c5f7eeb506ff94979be30362ec20206fed1cca190a9bc8bd4a79486d.exe

C:\Users\Admin\AppData\Local\Temp\1a0d2d51c5f7eeb506ff94979be30362ec20206fed1cca190a9bc8bd4a79486d.exe
"C:\Users\Admin\AppData\Local\Temp\1a0d2d51c5f7eeb506ff94979be30362ec20206fed1cca190a9bc8bd4a79486d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
d0c40d46290eaf3ad35a5d75899de130

SHA1
a3427becb0ecd4b5eda122b8f6aa3b408930690b

SHA256
f0f351cac51b30e6114ded89239d808f871ce4f36da00f401afedd2d3f03a0a7

SHA512
9c2a42c544c95ab985cddabc54430dd528625bb643d83dac6b55ae89c6fa899c6107acc5fa3508d86d188f6b5ddd319bcc715bcca74be7a05f07c3559fa02148

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
68b8d7640e045150cb0474a07d9a947c

SHA1
32eaaa7e91323db12ac854b4f0675b59649e8134

SHA256
f67bac0904047f02db9e3cb76d669e52a804ab73d95e6157c858c2b0f87cf5bd

SHA512
6db9b4ddad7ba3ca68495c693d1fdc392e002a9af2244d23bcece433758cf32ddcd696cc323db00c00ac873b9db698db53ca99e1c18f83281f284496d17b5118

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
5166f0f5d71a88cc7d220892c939c4ef

SHA1
ccfa5f92aacbc4d9a164f81eefc8c0da29278738

SHA256
b6b5bb105b1f7a7cab046eaaf6bd1e40babb5da6430b42e762352f21840750a5

SHA512
a83c4308c6c4f026a386dc2f8ebbd48731782317ed94df1e65cc3ba636014543f13055daba22f1ac4d377b2bc6c93b3d9441fcd4fcb0511e9663efce4f0545aa

Download Submit