7dba26d2529748088ba90c7c3b0d374649ac3b2efb2380608b7b5f012993f82a

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe
Size

482KB
MD5

f055c74729b56c8a7147af1ef0526932
SHA1

8b85b9046049f7c0e8b93b0ba2b9351e58a07f98
SHA256

7dba26d2529748088ba90c7c3b0d374649ac3b2efb2380608b7b5f012993f82a
SHA512

6dc43afa3828e58d808fd792b639de7c96a12991f7336bb755ab22361b7dcc3f931f45988f3cdfba5db84928a61e3df2db53d95802fa6c333ff84d16570c4638
SSDEEP

6144:bTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crCT4:bTlrYw1RUh3NFn+N5WfIQIjbs/ZmNT4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2920	17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\1210\logs.dat

Filesize
144B

MD5
99bf768b9864a0390617fa02bd1604c9

SHA1
a7ca054d16be69f04d14b905576f37287c34371a

SHA256
7c2578d0817bf65354611262049a0fb71a6e947382bd64061725732eb8a8e34b

SHA512
ae62039b939a93e3d1db70c5d12c6009de684c2e88259673c226def55e479fad406b6f4d9d519e0e2c2fe5a7d3cb45987576e3f70dc3a41c0dca321e998db0a0

Download Submit