c2720cbfa870cdca42bfb2e3a89b88a7a6581cdd759c64dc1156dfaf367b2581

Analysis

max time kernel
69s
max time network
157s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2720cbfa870cdca42bfb2e3a89b88a7a6581cdd759c64dc1156dfaf367b2581.exe
Size

10.0MB
MD5

ee05d28389d4413519df40a034010ecf
SHA1

ad459ca51eecb2f8d4abb2c34c944e3ca6e15f90
SHA256

c2720cbfa870cdca42bfb2e3a89b88a7a6581cdd759c64dc1156dfaf367b2581
SHA512

6bd33b4d81fc2da939390ee7c49cb4931cb4faa645f44bdd760dbc058573809a1de4c20157d1b6234419e57a42a6e4781ae887bbee196bf45d2ac8082c80c7c3
SSDEEP

196608:n4NS0NTxePePDdh0iCULKkOa8z1s6NXuAktmBlU4I4:nmRrDjtLKkOa8ps6puAktIz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2720cbfa870cdca42bfb2e3a89b88a7a6581cdd759c64dc1156dfaf367b2581.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2136	c2720cbfa870cdca42bfb2e3a89b88a7a6581cdd759c64dc1156dfaf367b2581.exe

C:\Users\Admin\AppData\Local\Temp\c2720cbfa870cdca42bfb2e3a89b88a7a6581cdd759c64dc1156dfaf367b2581.exe
"C:\Users\Admin\AppData\Local\Temp\c2720cbfa870cdca42bfb2e3a89b88a7a6581cdd759c64dc1156dfaf367b2581.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
59958b40fe6725553bf5ed21e5beabb7

SHA1
8f83fd13dac06fae4d11a0eea9415a7bb38b5293

SHA256
6e8cdb0699dc4014d81fa335851598591686e821aa2e91a87362a2bef9bd6e86

SHA512
f79d6aa05535b67b9225271772a6f6f0c0a785a626678242e47c46275c1030f165681c716db9fc75df65cbcd346b7932bce07d2a9790951d71901bd38b39f740

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
db1bd967d179af66766ff848b1481709

SHA1
fe3f5aa798a3474df6a3f509b8cdfb79f7125a6b

SHA256
7f81db4d80fbd990495fb96884a13daabdd93e1f73d24b2f4384448b9ed74922

SHA512
c2fd1c86d537dae2fbadfcc097b99b75ba1d4b6305d54e84f2b0055b954573dc3531d6d1e4054239237bb3051cfc55a591fc112116382e6ab3d25304c40dee02

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
da05381ed8493dc1c98837f93db2b0d8

SHA1
32e48140e65c9cf72170c25b93c28df7f9ffbda7

SHA256
641281480f4bae66012dbf860198d1c8325e3d7dd37882d1970039d25dce30bc

SHA512
91919fc661979387fa53a2b8c5104735357e0e0ecd3ed342c7a48d7aa67f5d4b5f830eaa89ba14cd69e1183e20282158c247fe8f795f075cce6184ce7f99f293

Download Submit