2e402d9779e3b3399479a69016a0912d2b5f705f33c2aa98dd2c819ac0829e28

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-11-2024 22:34

Target

17-10-2024 #20/Butcher Crypter.exe
Size

300KB
MD5

43482d098e195b656e54977dce80b5f0
SHA1

11e3b1480b1d28585d41a8977b40aab6edc15e33
SHA256

ddaef6b4bb022511ab3aee39fedd3d8281398492ff302043f3a26695926a167b
SHA512

10443b57b097513fa11e3f4a454caf5e33e79308e21dba02af06671f45bbcce0e4f459d6db4f7a67882294505fce950275c146a6973aea1f2990e774c65941c8
SSDEEP

3072:gjobicvNyopVpCV0dCvsBpID5n+nJNqRhnuNqRN9zQkLkjgqTCkigqTNFmFnNIWF:gjlcvNyoJCGCvsBpIen

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Butcher Crypter.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Butcher Crypter.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Butcher Crypter.exe

pid process

2556 Butcher Crypter.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Butcher Crypter.exe

pid	process
2556	Butcher Crypter.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact