ac3f2f7d9123e463e6938909189eedfbd41484e1ff0042d1c023f61a521397df

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac3f2f7d9123e463e6938909189eedfbd41484e1ff0042d1c023f61a521397df.exe
Size

11.0MB
MD5

2762712057e2bc633631779f30873c78
SHA1

9a3cab8cd3240222610c288a07e9e4d0550b7760
SHA256

ac3f2f7d9123e463e6938909189eedfbd41484e1ff0042d1c023f61a521397df
SHA512

cc3142e67dcc5abaee59a1de68124748543e60c79887605a9cb0922aae69f9cff09b33c75f96ee5595f947450714b968f4851ee84ce2a2dd384f249b761be1c9
SSDEEP

196608:J1WWWNNAsS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:J1WdAsRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac3f2f7d9123e463e6938909189eedfbd41484e1ff0042d1c023f61a521397df.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3772	ac3f2f7d9123e463e6938909189eedfbd41484e1ff0042d1c023f61a521397df.exe

C:\Users\Admin\AppData\Local\Temp\ac3f2f7d9123e463e6938909189eedfbd41484e1ff0042d1c023f61a521397df.exe
"C:\Users\Admin\AppData\Local\Temp\ac3f2f7d9123e463e6938909189eedfbd41484e1ff0042d1c023f61a521397df.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
3KB

MD5
6fd7068f5803271b76fb8c10dee6c524

SHA1
185a99821c732d78f2495094eb41ef6c72b59dbf

SHA256
a1bc0d71961591572e4a3aa0a20aa01dc3263306756e0278db217ee93ec0d1e6

SHA512
75b0725b737a440ecaf9dd54c3b4b98c9fdb0e6de8c334fe5d6c407143599a75088710f5f0e4dc11851c6d3870d7b08fe8ac50b34d33b8aaeef116e2c66c3c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
233939fc3ea4aa1ca8a76861ea0dab5a

SHA1
49e83934ee2e0ce69455f8eaad4f4e05e51e8b39

SHA256
2baf132538e2eb2540342e05fa91d924736fa8a81e593899d695bfbb42e70520

SHA512
2ebf6c6a20d50c995a1b6bb6a01a1dd4ffd829a2448fa83f4153b59a982dfcebae52b2ac2e2bf669b8e03893e50491e22f9a9a4298f705e199a3f4370ca3a9c4

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
246399010ae8a95c799611fffd03089f

SHA1
711d61e31c405713ec8d6f659cd20df140539fff

SHA256
e78894b6074bbaa0d7e9f5ffe6483a2d9bee14b9d932c7d666f87b1f3124f460

SHA512
09bc220e5462cbaa8e774ebc928453b0a482829fbe857cb7235926d92e3f90c9cab5b646b65e81f2c82aefccfbba4ea807c3ff4659b8ea92e8aef37da1295754

Download Submit