920193af64b304f53f9eed33f21dbd42ad31335cebb7aa6f1395ac1d91da5e7e

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

920193af64b304f53f9eed33f21dbd42ad31335cebb7aa6f1395ac1d91da5e7e.exe
Size

4.1MB
MD5

043df48a839dd0c501e6e3076b67deab
SHA1

9e8cbb4a4a7e2712e173967a02199308b0ed62e0
SHA256

920193af64b304f53f9eed33f21dbd42ad31335cebb7aa6f1395ac1d91da5e7e
SHA512

67f31b93e3cf356aa15cdde1f5b44f28c9c215fe97fd1b00226893a5db1a61027239e134a138fcdb75564c25333d5d57dc411b301a433012b448b468c485d5b5
SSDEEP

98304:S2pfqLc6Ia3QRIy3RoHrmHhf7nb891PM+G+b:aIvaARIy3RoLenw9m+lb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	920193af64b304f53f9eed33f21dbd42ad31335cebb7aa6f1395ac1d91da5e7e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4456	920193af64b304f53f9eed33f21dbd42ad31335cebb7aa6f1395ac1d91da5e7e.exe
4456	920193af64b304f53f9eed33f21dbd42ad31335cebb7aa6f1395ac1d91da5e7e.exe

C:\Users\Admin\AppData\Local\Temp\920193af64b304f53f9eed33f21dbd42ad31335cebb7aa6f1395ac1d91da5e7e.exe
"C:\Users\Admin\AppData\Local\Temp\920193af64b304f53f9eed33f21dbd42ad31335cebb7aa6f1395ac1d91da5e7e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4456-1-0x0000000010000000-0x00000000100D3000-memory.dmp

Filesize
844KB

Download
memory/4456-4-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/4456-3-0x0000000077352000-0x0000000077353000-memory.dmp

Filesize
4KB

Download
memory/4456-5-0x0000000010000000-0x00000000100D3000-memory.dmp

Filesize
844KB

Download
memory/4456-6-0x0000000077352000-0x0000000077353000-memory.dmp

Filesize
4KB

Download