8bbc1f599ab3e9a12b37648c79b785072be32fdeac096691c83b607ca013c3b0

Analysis

max time kernel
95s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bbc1f599ab3e9a12b37648c79b785072be32fdeac096691c83b607ca013c3b0.exe
Size

10.8MB
MD5

22b3954667b1b7a65bcb35620c6d3450
SHA1

d353a4020bec2845d4b8745395811b25dc73a905
SHA256

8bbc1f599ab3e9a12b37648c79b785072be32fdeac096691c83b607ca013c3b0
SHA512

09210523d5431fd6f93a3a41617bbdfc1d4b306af9d9b134b8b4645eb0da5af8461d29517638a46588b8003ac4e1f49606b34735bae4e9d2f7baca1b084f4d9c
SSDEEP

196608:ylWW9DrFSSJ7PbDdh0HtQba8z1sjzkAilU4I4:ylWO5J7PbDjOQba8psjzyz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bbc1f599ab3e9a12b37648c79b785072be32fdeac096691c83b607ca013c3b0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3600	8bbc1f599ab3e9a12b37648c79b785072be32fdeac096691c83b607ca013c3b0.exe

C:\Users\Admin\AppData\Local\Temp\8bbc1f599ab3e9a12b37648c79b785072be32fdeac096691c83b607ca013c3b0.exe
"C:\Users\Admin\AppData\Local\Temp\8bbc1f599ab3e9a12b37648c79b785072be32fdeac096691c83b607ca013c3b0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
2KB

MD5
338fa03aa26cb8c3ebb2ae190bba614b

SHA1
61e72abef659bf07d9b79a186b2c296fc047e5e2

SHA256
4a5a920a521b2ae6fb9c68c3404237ce071119af4c76b570b636ed8a8d99f1a2

SHA512
0245fe7b51854b05d5d17999f452fa489e41528a13bd5a285d65efe788fae17e4b814464fcd9d8d8b7e126b60fc5034c6a1b177219cb67ae43ab593955fc6640

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
07230c08d0b4f934fb02fb75a8b3257f

SHA1
633aa36a8e596b9a3fdb65e3626b3e6f4b94afc3

SHA256
bde3e9ce2f1c058cf248353b282be334d27cc5c1e0a38a4a88fd7714df5ca1eb

SHA512
6975b4971f4c8fc1bb8c8ea99d7f9bfe1db540807655f11186e35153bc326f01effaaf4dbcccae6df54f2a15a8cd2e5405462d052d22b07bd184ded58e9be70d

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
d5d5ed74c58d88923bf20cc8f978170c

SHA1
1d3ec3747ad7a31c8c39e71af38cf738520f0c38

SHA256
9395835430d21e8d80d6c2ee91c43c4018aeaa20187c1a394e0bb052bdad6569

SHA512
d86d92a94710f5f2d6768233ff9c2fdae4d299b595596150da098e89c8f2b632734dacd500c26a3580eba2581b74e0f234ef835342fd05f48268552b52bd8f06

Download Submit