8e8028cc373fbf50dba9c54217e80cc1e1bfe00d972dc2352b41f19814fd3566

Analysis

max time kernel
147s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c1c2c54b4c18070058284e889de5bde72396d9a5a5e959deb38cf19ed2f6aea.exe
Size

469KB
MD5

d61e8883e8c9d4c92493839bb4a34e54
SHA1

58eb46904d8550d779d906858a95c18084d5b6fd
SHA256

7c1c2c54b4c18070058284e889de5bde72396d9a5a5e959deb38cf19ed2f6aea
SHA512

1d4264b5fe7e00ef462047ef5fabf465f20a1337159751baf2b25f3c1289ae13a7c6404316f0ca795a2bb66ce2607a4804404e8ed42f6187d291ff67bbf3e000
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS3n9:uiLJbpI7I2WhQqZ739

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c1c2c54b4c18070058284e889de5bde72396d9a5a5e959deb38cf19ed2f6aea.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2688	7c1c2c54b4c18070058284e889de5bde72396d9a5a5e959deb38cf19ed2f6aea.exe

C:\Users\Admin\AppData\Local\Temp\7c1c2c54b4c18070058284e889de5bde72396d9a5a5e959deb38cf19ed2f6aea.exe
"C:\Users\Admin\AppData\Local\Temp\7c1c2c54b4c18070058284e889de5bde72396d9a5a5e959deb38cf19ed2f6aea.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\pdf\logs.dat

Filesize
144B

MD5
a698e2dea37ca0af57192704672aa521

SHA1
3cbecdf749c8cfd43200a216cef8d30ed20e9269

SHA256
3a58936a025255b56f00e4cad137fb7cafd79fc3255e899ea0904d2178c8a838

SHA512
3f9673ae72541495acb2be476dbe3c0ed4a2fa7167f5b3d67e190ff0994c147398a3f1c16e3e229983e2b88733639b650c0962bcdc3c7e85963773ab18873c87

Download Submit