937c6d89cc477738beb206fde3ecb125d11a1b494bec547a993647a28adca255

Analysis

max time kernel
95s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

937c6d89cc477738beb206fde3ecb125d11a1b494bec547a993647a28adca255.exe
Size

10.3MB
MD5

47df77558743ef4aeeeb1767d4f9fc58
SHA1

c519a31aec3c5436e1e2a3cbba15fd836e8bfcf1
SHA256

937c6d89cc477738beb206fde3ecb125d11a1b494bec547a993647a28adca255
SHA512

c0ac8a3840a5951f6ec6ee727cae44628625cb4d275dea8919f1aa4d547ac3880719341940c2a33537c45956ee08a7ea71929c467dfaa443b84c4ea293bcf490
SSDEEP

196608:dXHSVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:dXHuf+6poDjBTRxa8psYSUa+arvSP0z

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	937c6d89cc477738beb206fde3ecb125d11a1b494bec547a993647a28adca255.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3464	937c6d89cc477738beb206fde3ecb125d11a1b494bec547a993647a28adca255.exe

C:\Users\Admin\AppData\Local\Temp\937c6d89cc477738beb206fde3ecb125d11a1b494bec547a993647a28adca255.exe
"C:\Users\Admin\AppData\Local\Temp\937c6d89cc477738beb206fde3ecb125d11a1b494bec547a993647a28adca255.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
7KB

MD5
d0975bb69a8ac11d75771d8b87d0a5d6

SHA1
f9d4ca3854b879605343bc6aa184d478823f0659

SHA256
ff42d5786f9a6f060b4e68cd5c3140f9a74e35a1e79786983296ed17e93ac465

SHA512
a27536a953bf249afbddf1b661d14cf905e5d5694df2ebc09b41a5dd4164cf5417d40297f01c5f32d4b6aa9377d61b0be6bd2bb17d53fd772bb23b48eaccdf89

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
83ff679dc97185d7cdb4b7725cec35d1

SHA1
b54e3e151ac856ecd73422501957dbafbe4e2e76

SHA256
eb14ecaf9e065ff85adaeb2cbe62b5a79b23334e55a768bbcdfeeb3b36b013dc

SHA512
df0ba046ccdf696485076dcbe4e1f74d821ac0ab96e044d0a5e132534b97f94acd6918d1bffb3ce9696699dc65e9e198c54ada174ce9b5f74f27bb10701fc539

Download Submit