aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa.exe
Size

11.0MB
MD5

d3b31bf2210ab69dd02d1f818252c43f
SHA1

afb9e448ef125b5b64e8d4b0cbe4efd76251beef
SHA256

aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa
SHA512

857ff1eacb080765b43654c0c9bb851f7da791f6f6540438ae5009e27d2de6dd3f52f50b3e867eb3770f021046121fc4deba5dac1d94c17f3c79e09737580495
SSDEEP

196608:J1WWWNNAsS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:J1WdAsRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2764	aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa.exe

C:\Users\Admin\AppData\Local\Temp\aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa.exe
"C:\Users\Admin\AppData\Local\Temp\aacd65481a3ce41ddd9891a9e9e7afa112fe35b154d413d81aec614100b3f2aa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
1872a7c76d14e27f304ce22f318a50fb

SHA1
417ce9984be6ed5b14a02f107799c150d773dfed

SHA256
45c320b206c902eb3a54d1c7376d6e3fd40f79cdae39b0c3a34deed2683f69ba

SHA512
dd1e95e487521f98e7dfa123d46010c12d85ebf34857dbda0ab7c4cf5c7606e79da8fd9e17ea3d239d2637c21c796c30e359ea9bd2e3d2a8477a5c616557100b

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
87b98de4a23d0a834aab43978f1bcd87

SHA1
af4173d40e3205c9005e484c482c5d019a0db4da

SHA256
18ff0e96f2c01740085ce15345be40646a46acbbf46cb642fcee93371b8d1200

SHA512
32b4e6d8a1a471ec16b5546670ac5dfc831fa24745dedce71e240d53bea46d952fb083aa6c810bd68ca6ff97659b210428f235b61b37f8b4a3dbc8b7efc4b420

Download Submit