896a972d0bb597ccaa0dbe2a2cf9707aaa29c3e7c2a6254757f33271a409c207

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

896a972d0bb597ccaa0dbe2a2cf9707aaa29c3e7c2a6254757f33271a409c207.exe
Size

10.0MB
MD5

75f48ae91ab6da7f763c4519662590c0
SHA1

bd05bd79785f1139db829b9cfb3431f45600a283
SHA256

896a972d0bb597ccaa0dbe2a2cf9707aaa29c3e7c2a6254757f33271a409c207
SHA512

6ad8f8136c3f60bf5cb29ec559fb3a1e8d61a6e9a79c79b6bb598c2025efbf9d1cbd5bfaf26b9913c65a90234272e153a8b402aa9b0b8990aa3591034427655e
SSDEEP

196608:arS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:arRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2204	896a972d0bb597ccaa0dbe2a2cf9707aaa29c3e7c2a6254757f33271a409c207.exe
2204	896a972d0bb597ccaa0dbe2a2cf9707aaa29c3e7c2a6254757f33271a409c207.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	896a972d0bb597ccaa0dbe2a2cf9707aaa29c3e7c2a6254757f33271a409c207.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2204	896a972d0bb597ccaa0dbe2a2cf9707aaa29c3e7c2a6254757f33271a409c207.exe

C:\Users\Admin\AppData\Local\Temp\896a972d0bb597ccaa0dbe2a2cf9707aaa29c3e7c2a6254757f33271a409c207.exe
"C:\Users\Admin\AppData\Local\Temp\896a972d0bb597ccaa0dbe2a2cf9707aaa29c3e7c2a6254757f33271a409c207.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
9b85a4da0d35616402a8d1d2778c1aa7

SHA1
71a8b56aabfcaab8a52293c806d330c8da628681

SHA256
47b3fa1338373b1c7516d3ce86244c354cc758b8a767571c3b4e0cff887ee1bd

SHA512
d071d02b390997dc61678edaceb94a873d700a824ccaba890e7ed826abd7f1553b42b129ab1f2b77662f4e5224b49b0c6fae771ba5ad490b4d196d952ee015a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
4feb1ca740f574263c718f81e4cff31e

SHA1
298be39a36b12194bd83c05850ee553df9579e79

SHA256
d9e5023bbbeb61ba1760ef0042ae9a14811580b1e58959c5ab109743d5845cf1

SHA512
679717025418030a01c81d9cf1ee532034f0a37f51c35e791d4ed5ad5c49b7e1221e7a9a92c18e035cd2b8b011e3354bc983e8814279a5c1c34aadbbc456209e

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
9b9300ea023c11286e24c073d4202b59

SHA1
1b0540806cde011af89a0ed9a51d524e12dbf5a1

SHA256
b2f9a3cbcd53d492c111c716b023990381597dcb3101d103dba8d222b94904c5

SHA512
4f58d970ae17271a6bd4f50d84189b4975b4a4abc4bc55696a16fc0f468ee1db38a9f1b3be552f0db6e8b26aeb89022386b6b3cd631072a081be4c2255767329

Download Submit