5855ed03a02b03ffcf28ba691236dbffc2e429841f952e904048378dd1bec265

Resubmissions

29/09/2024, 15:11

240929-sk3npaseqc 3

29/09/2024, 15:08

240929-sh684aygkk 3

29/09/2024, 15:07

240929-shbr7ayfqn 7

Analysis

max time kernel
34s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
29/09/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Odin3 v3.13.1.exe
Size

3.0MB
MD5

ceb4816701fb8f72d5833ca6ab082586
SHA1

b15867efa30e86927e2a77f6455a646a757a8784
SHA256

370b97504c91f5965abe69db11576a78370674f363460fa5fe15fff783fa0d35
SHA512

f50429ac1fe9bcafbf641bc934ede772cbb69c85f232caccbb73c07be869f0c7fdcf08bee2e2f0c790a611c59c074e9ee75c7f91ebac93a12b47d294fca49153
SSDEEP

49152:8HAz5ewUdUjqnZp0iV8W6LixkJPtakXP9QtjmBtaBASMt73t/IdeT+2nWXveH:fz5nj5iV8FSGIkXP9QtSBtwrMt73tg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odin3 v3.13.1.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2992	Odin3 v3.13.1.exe
2992	Odin3 v3.13.1.exe
2992	Odin3 v3.13.1.exe
2992	Odin3 v3.13.1.exe
2992	Odin3 v3.13.1.exe
2992	Odin3 v3.13.1.exe
4548	MiniSearchHost.exe

C:\Users\Admin\AppData\Local\Temp\Odin3 v3.13.1.exe
"C:\Users\Admin\AppData\Local\Temp\Odin3 v3.13.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2992

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
d12e797f18cb79137ad12b5e5139e1b8

SHA1
f15fb437b1be86b714e278ce927b315fa0e16ea3

SHA256
afb0f4a0229174f8118ab512b569fdb9eb3ebb0389cb11c9f4a0a2aa88ec258b

SHA512
f6e8f99bcd0ecff7683c8e56fa2ffa3fdff16d6c17a2066b36bc3d78e2838130b5b23059a239b29a7ebdd0b5ca36b3f9cf388945bf1aad50a3f91cb8091223cd

Download Submit