fae30ec7ae353b323494733972d28f9f4fee9621c27d6b30cc0af003680cb2ac

Analysis

max time kernel
127s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fae30ec7ae353b323494733972d28f9f4fee9621c27d6b30cc0af003680cb2ac.exe
Size

10.4MB
MD5

2e924f737412bb868e091b3117608796
SHA1

74e1d8db7d86584095ff2c674140ec9266a39c06
SHA256

fae30ec7ae353b323494733972d28f9f4fee9621c27d6b30cc0af003680cb2ac
SHA512

aaad3062e5292b614c3f3bec050aba132ebd58897b3f00bd2f8b427f792535dbb6523c51ff468a52b284941c0231350c02fadd55dba742ca8f391c39a3ef03f6
SSDEEP

196608:cG2+BwqCvvSSJ7PbDdh0HtQba8z1sjzkAilU4I4:czyEv5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2424	fae30ec7ae353b323494733972d28f9f4fee9621c27d6b30cc0af003680cb2ac.exe
2424	fae30ec7ae353b323494733972d28f9f4fee9621c27d6b30cc0af003680cb2ac.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fae30ec7ae353b323494733972d28f9f4fee9621c27d6b30cc0af003680cb2ac.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2424	fae30ec7ae353b323494733972d28f9f4fee9621c27d6b30cc0af003680cb2ac.exe

C:\Users\Admin\AppData\Local\Temp\fae30ec7ae353b323494733972d28f9f4fee9621c27d6b30cc0af003680cb2ac.exe
"C:\Users\Admin\AppData\Local\Temp\fae30ec7ae353b323494733972d28f9f4fee9621c27d6b30cc0af003680cb2ac.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
b1450cf7a0815b6870447c4f398a8bf4

SHA1
348d9ca6c071d5fbe518939dc328a9eb1d83240b

SHA256
1082ca032b25037d0ca90c0bd5e607f713f8f410105e3ac2eddd4d9fde1051fc

SHA512
ea6fcd0b613a920be29e535c1c65ce3f96b4087b3edde8a78990ed58637298c60f94596ddc90525604d63f38163b0ae339ae4515d6242add39f7d6cc93848a84

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
3a557004d4cf0de80f13bdac541b0bc8

SHA1
259374699d1dda1f4c97cf99a37a88d5d9072902

SHA256
9423957086f79cd9043932a554c387b81e5fce8ef0d22efe8bc60c6bb7993c4f

SHA512
08f45359ecadfb5c7e074cd7ba95116705fbea67a3fc1a901ddd81a44a633c648637e5044e17b6a61fc1869a28e524c605fb72a2ad11d1c1f163d8918369ca48

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
15afb225e18d3b81b9d1019e954583f7

SHA1
87a596d24d54c76ca3e7059177a89fd7b5dc7a98

SHA256
086df09ba74ce29d4ee2af6e636c95acc6776f2ab274c5c2f853745160fafa77

SHA512
c117a31ac321089eebfd44c0d77900f927b8829e901d4421a7b28bd04a645b1f2e3e8542309c144d1a7dcec6cac5ae2a8e35789a3527ec586ca2f562815fbd3d

Download Submit