bd398e2ee1a2fc551724113752da2e05b386f5d82b5aa838e6b7ea582f26d112

Analysis

max time kernel
94s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Download_N982028892_.exe
Size

248KB
MD5

b0a2b55bfe97d004a4c3f19a4673ad6e
SHA1

0b9fae31737e80f663abf94217dbfc1f83e854eb
SHA256

341150f050eb74f025873c7c3e8b1a4b1f19d24798699b586f5e018b37649ad7
SHA512

e0cee49d6330d32bf87b9c4bb263dd9cc746da9cc74205403a9c6570c116949d16cb195693d0b073293379aa0d41c6acff09091da07805a5a5b1916f383f325c
SSDEEP

6144:7kT4/xPLn+aC1meyUGimMqMa3l3lQ1jqcUoYvm83e5:7N/x7W1meyUGpEa5+qLmGk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Download_N982028892_.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Download_N982028892_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Download_N982028892_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Download_N982028892_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2052	Download_N982028892_.exe

C:\Users\Admin\AppData\Local\Temp\Download_N982028892_.exe
"C:\Users\Admin\AppData\Local\Temp\Download_N982028892_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-0-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2052-1-0x0000000002B50000-0x0000000002B60000-memory.dmp

Filesize
64KB

Download
memory/2052-14-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-16-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2052-24-0x0000000002B40000-0x0000000002B41000-memory.dmp

Filesize
4KB

Download
memory/2052-23-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/2052-22-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2052-21-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2052-20-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2052-19-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2052-18-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2052-17-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2052-15-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2052-13-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-12-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-11-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-10-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-9-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-8-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-7-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-6-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-5-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-4-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-3-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/2052-2-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/2052-28-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/2052-34-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Filesize
4KB

Download
memory/2052-33-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Filesize
4KB

Download
memory/2052-32-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/2052-31-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/2052-29-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/2052-27-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/2052-30-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/2052-36-0x0000000002D00000-0x0000000002D01000-memory.dmp

Filesize
4KB

Download
memory/2052-35-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/2052-39-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/2052-38-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/2052-41-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/2052-40-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/2052-37-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2052-42-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download