89e9fcb979903d8346ef038b42d114ff00f48299549c58e930734ae924ea0b0b

Analysis

max time kernel
93s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89e9fcb979903d8346ef038b42d114ff00f48299549c58e930734ae924ea0b0b.exe
Size

11.0MB
MD5

6e0d401598e334ee3f618630937c9214
SHA1

85cab6a1e49fea86e35ed319c1ba7a7f359bcbd2
SHA256

89e9fcb979903d8346ef038b42d114ff00f48299549c58e930734ae924ea0b0b
SHA512

d1483d51a1b71761f5c3faf1bb29b7d22b293de3cc3935bb71c4af67da3e2a1bfb1a5dc722c8e81f69d398555b1a16930f2ceeb443f46969da5bf24fe2b3f9b5
SSDEEP

196608:J1WWWNNAsS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:J1WdAsRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89e9fcb979903d8346ef038b42d114ff00f48299549c58e930734ae924ea0b0b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2352	89e9fcb979903d8346ef038b42d114ff00f48299549c58e930734ae924ea0b0b.exe

C:\Users\Admin\AppData\Local\Temp\89e9fcb979903d8346ef038b42d114ff00f48299549c58e930734ae924ea0b0b.exe
"C:\Users\Admin\AppData\Local\Temp\89e9fcb979903d8346ef038b42d114ff00f48299549c58e930734ae924ea0b0b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
2dfb319977da5709819e6a736a3cd7a3

SHA1
e1483315c4a8260a3443c33148bd31fd47997655

SHA256
a3b4038d77ddc6ddcc317971faedfec6fa278cb030aa7e9b9b58cc77852e190d

SHA512
fbc7cd7a2d5e463d785bd10123949cc4285c3c6cdd9510b061f90e29a77c1d3ab4e831c37241f2f0e7705decf6b30b039abce0ad33a2e023d291293262391d22

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
2f22fe668e06104bfba0e61645099077

SHA1
736da93092dbddf5c30a7377e6a25f1c7e83852e

SHA256
5aeb7e0ae8fb1997b62e4da8714d57040813d38fa9a6189f1330fc019a909795

SHA512
dfb3ea6c18dc8266ac08238351060757bfa070c5192cf42dde4e3a4231534a98af70909449a668f15197ebaeaf7dab6faa2002edc77dbf43177ad8dc68454570

Download Submit