cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79.exe
Size

1.1MB
MD5

a75ad5790559fc719a75acbb2780e669
SHA1

ce0b6b7b0daab55b3db0488ed095dfe8a4fe1c78
SHA256

cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79
SHA512

a1d0afddaf80f84c8f2c3cbfe793f5865d87fd58d2ca82a3c3d82ddd1a01a0375f1d7d999025941aa48ec07b02c3eb57ff1659df8cbb11f250ad362461c73890
SSDEEP

24576:36jGxU6VW5e5w2Y2qzoUMkz1OgaoUSdxoxt:3fqEw9zoUf1OhoUICxt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2748	cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2748	cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79.exe
2748	cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79.exe
2748	cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79.exe
2748	cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79.exe

C:\Users\Admin\AppData\Local\Temp\cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79.exe
"C:\Users\Admin\AppData\Local\Temp\cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cf1b4ab3030f62d31c0ad89a5e78eaf7ce87139685679b092bb6f3193e339a79.exe{4A17A5BC-2A99-45cc-B2BF-396F1520AA65}

Filesize
1.1MB

MD5
8cc6743bb632baf9c1a776a91959373b

SHA1
7c78bab90a8c5814456af73d6b81bf53af079936

SHA256
512e36f07bdb12cebb0d42e5887bbf33af1314b940a3a61b869ed29f2b04b669

SHA512
5262e06b0c628dc9e21aeb14eb64a594a528c898ce3dcbb9a23ccf6fe1bcc1f550b66bba58c09b4b5b0a65a52d64dceaecd0e00be69ed93231c38991fabb94a8

Download Submit