7218d769560965ea072fb83188e0cc3a15e1b3bb2dee628c99f456e90213ad89

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7218d769560965ea072fb83188e0cc3a15e1b3bb2dee628c99f456e90213ad89.exe
Size

10.3MB
MD5

04b41bddca4deaeed5296ac1a1d2915a
SHA1

1e6f73aa20280b1561b4d4222f6ec620f2c751d3
SHA256

7218d769560965ea072fb83188e0cc3a15e1b3bb2dee628c99f456e90213ad89
SHA512

50a31065327efe67f91bc419415acc3af3a15e5c94d30bd020bd6b759e55b3a738c6eab9d298649468964b732db1b369c06901dd738e2e8650b12d492c92ae4d
SSDEEP

196608:dXHSVf+6b9oDdh0qTRxa8z1sULDSe9a+5crvT9YqS4lU4I4:dXHuf+6poDjBTRxa8psYSUa+arvSP0z

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7218d769560965ea072fb83188e0cc3a15e1b3bb2dee628c99f456e90213ad89.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1908	7218d769560965ea072fb83188e0cc3a15e1b3bb2dee628c99f456e90213ad89.exe

C:\Users\Admin\AppData\Local\Temp\7218d769560965ea072fb83188e0cc3a15e1b3bb2dee628c99f456e90213ad89.exe
"C:\Users\Admin\AppData\Local\Temp\7218d769560965ea072fb83188e0cc3a15e1b3bb2dee628c99f456e90213ad89.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
6KB

MD5
7361ea4c27788ab42a800e3f9a861b22

SHA1
057616a90df5736b1ac49c728460e6c457384309

SHA256
a23051dddb67f2a7e85745af0c4046b5bab742769024188626a29076f1cd79b7

SHA512
9fd2ebce198f344d40cd8d77f478a9d8c9fd8ecafc4303c16cb13dfadc591332fe6cba6d7af67dcdde043d9d1fef685f33b301cfaa610be7a04b6fe5dee60062

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
1416b8eff26e93a86c7eea1ef45b448a

SHA1
c318aa9d859b3def3177c878ac958f665b5eae15

SHA256
edf10d38d81a37c90a5fd95f6f660ab5538ec183e631771beb836c21cd9092e7

SHA512
980135b57ad7cb2a38a8238239225cbcc7cd1fbea43e309e1c3581f9b05ac467693a64ae3e796de620a6079f25622358e7c060d41873b603fa87ae975468c16c

Download Submit