b7d2ae452ea7a5ca54c2cf066144174ccda210dfd30936fda1879f0d623e382d

Analysis

max time kernel
117s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7d2ae452ea7a5ca54c2cf066144174ccda210dfd30936fda1879f0d623e382d.exe
Size

11.0MB
MD5

b999ebd5c7847ef52792e69a21dadef8
SHA1

ea21a16816b58aa7fb47834b67d354348951ad66
SHA256

b7d2ae452ea7a5ca54c2cf066144174ccda210dfd30936fda1879f0d623e382d
SHA512

5acf1514cfe00e6a1110532a0922f858bb5a12aae5761f3e99228a3598c5ae9ca964df013ac8c0d674db3d08615457f86bee23a00e6d55d692f9fc92cf844eec
SSDEEP

196608:J1WWWNNAsS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:J1WdAsRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7d2ae452ea7a5ca54c2cf066144174ccda210dfd30936fda1879f0d623e382d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3384	b7d2ae452ea7a5ca54c2cf066144174ccda210dfd30936fda1879f0d623e382d.exe

C:\Users\Admin\AppData\Local\Temp\b7d2ae452ea7a5ca54c2cf066144174ccda210dfd30936fda1879f0d623e382d.exe
"C:\Users\Admin\AppData\Local\Temp\b7d2ae452ea7a5ca54c2cf066144174ccda210dfd30936fda1879f0d623e382d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
914f9c62e2f252da03fcf802f46226ac

SHA1
63ba5284774426460c46e76b86cba3b5cd069bae

SHA256
82d47ff73e0acac4661ce0f1d9c457acd09fba1ae5ff3a2e887a183018a17fb8

SHA512
496ca17f53f25624124b21f875b6e7a2de3e516cf53ba56c12bfd92c29744c6217684e073bf7021cda98a462d742bb423600e37d9e0e522e4c9fe0f35452300b

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
016907806af981df2cf66cb86e0aea7f

SHA1
336c4e5e333bdf498344e29298b2765936cf6327

SHA256
88cdd5a42e0f3392064c7ac00db0a740a0760f6796646cfd8087b3bf79b1cdda

SHA512
abd6520c35ef3aa1f6546df9d8290a4d552dcbae0eb9d315afb5edd446aa0d6fa5034d88fdfa7f4416299d42ba43786ffe2a99791ef90d5efb7db6b585ab892e

Download Submit