aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa

Analysis

max time kernel
142s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa.exe
Size

11.0MB
MD5

d3b31bf2210ab69dd02d1f818252c43f
SHA1

afb9e448ef125b5b64e8d4b0cbe4efd76251beef
SHA256

aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa
SHA512

857ff1eacb080765b43654c0c9bb851f7da791f6f6540438ae5009e27d2de6dd3f52f50b3e867eb3770f021046121fc4deba5dac1d94c17f3c79e09737580495
SSDEEP

196608:J1WWWNNAsS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:J1WdAsRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2480	aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa.exe

C:\Users\Admin\AppData\Local\Temp\aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa.exe
"C:\Users\Admin\AppData\Local\Temp\aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
ac534852becc6c5098356eb46e5b7715

SHA1
f9864960ce8aecebf734add772aa70a6c1716714

SHA256
1aa43eb2c06beb43b7604cb931eb228f950e1fb893d3186cd2d9b3280345b773

SHA512
552bafe3f2c497e995553f229da98f0861f3d334c554f127a99b42b3c39a2e1eaeda48eb312eddeeb43b62bc4de855fead4d087030e8df05693f1ee0b474bd88

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
c1996b6fcd5b0b4aedbde898a834c0ff

SHA1
d65ce247d3592a312ff6fa9a65fd16bc7e56d80f

SHA256
0ee24177b8d318ed7f8658149b27f0705f3bd9c5b5afed9b93556a6939695f08

SHA512
ff1a1ed0ca03780465cddf8a506e5ebd2b476e211bce482af269c9118247d28ee785d599e30c676fa8c4e65d8136709475339b3f36d5917bb1d7f7da84fb85f7

Download Submit