7a38d0e565189043b232601549e9e5e5c6c5358d696016e22069223c60c7213a

Analysis

max time kernel
119s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7a38d0e565189043b232601549e9e5e5c6c5358d696016e22069223c60c7213a.exe
Size

11.3MB
MD5

aae37dde7f7647e1b58140036a9ffced
SHA1

0b16ac8929054a47f5b72b1053a21c8ad285447f
SHA256

7a38d0e565189043b232601549e9e5e5c6c5358d696016e22069223c60c7213a
SHA512

40aae73f80aabcfaba966d987169d59b4d5b64e573b6b49ab18ee9b918a3487369cbba2cd86d9ceb1b2d4d3aa98115b93c1e61f78c4e73624f5825f4412e6d53
SSDEEP

196608:RXFGPpySVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:RXVuf+6poDjBTRxa8psYSUa+arvSP0z

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a38d0e565189043b232601549e9e5e5c6c5358d696016e22069223c60c7213a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	7a38d0e565189043b232601549e9e5e5c6c5358d696016e22069223c60c7213a.exe

C:\Users\Admin\AppData\Local\Temp\7a38d0e565189043b232601549e9e5e5c6c5358d696016e22069223c60c7213a.exe
"C:\Users\Admin\AppData\Local\Temp\7a38d0e565189043b232601549e9e5e5c6c5358d696016e22069223c60c7213a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
1KB

MD5
c67b0f83ab7119434b71f436bf67bbae

SHA1
554a51184173c134fbf531e4cd9aa2352fab40dd

SHA256
aae2f4e59856e4759936b1a199c861c1b3d735dac39cd55702d1dc81b24b7981

SHA512
bd1f7e0416209748d08fae53f9bc20c606e24f6acbdd60840953bc37aabe620cf68377f3b76cb60b192ce00343992cd69eed6d6e275c115caf91aae23767ac6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
9KB

MD5
534ff01d798c04ea7e3242a1a1ba90d5

SHA1
a42735a40c50d354bc99413ce7db9bdca26e0b38

SHA256
3276271fad4d6f962a348b6fb505df6aed2c7ce51d8607abd5910ff839e63720

SHA512
9b84390b83b4f19e134b147c29152b1cbcf64c3f972bd92a092cf5cbcd5d3abae16cc0095c9e427d5205ddffef4675856d6f44250af4792c051a280ebb238601

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
31926be8ded34c56866179fd146feba0

SHA1
e7893110ea4df2213f857beecabe9e85e3a5257f

SHA256
e5e363e267f07805fe96ccf03587b61bd787d4b07f253271b032b38ce67e2ae8

SHA512
17a036a29cc8a5aa7594a3c0a4ea62d065370fec330b225251944d1f81a07c1ebf9de69fee6ba3910a92f04e782e050b44baf49b1b619e1f8031fa758260562f

Download Submit