252d5af9c304aa9a17b029f19e3c3cb2d113425cdb34fedb4ff65618103b1418

Analysis

max time kernel
94s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

252d5af9c304aa9a17b029f19e3c3cb2d113425cdb34fedb4ff65618103b1418.exe
Size

7.9MB
MD5

20c2be9b01d064c2b7b3cdfe1c3cd4aa
SHA1

d632390b6e49cbe3cda1cdcd2a4e7d4244ba2f4e
SHA256

252d5af9c304aa9a17b029f19e3c3cb2d113425cdb34fedb4ff65618103b1418
SHA512

8e39fb947686576983bc02f3a87e36655860872b8e7056f32a395ab0f5889047865925f69dba8a0868d8a4b0480558efa3aedd2030868726f10d9bb16f138002
SSDEEP

98304:Xg49ZaYwsmJdj9PfPHRCjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafD:XgP34NTx9Pe20/zkOiu1f+79YRck

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	252d5af9c304aa9a17b029f19e3c3cb2d113425cdb34fedb4ff65618103b1418.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2784	252d5af9c304aa9a17b029f19e3c3cb2d113425cdb34fedb4ff65618103b1418.exe

C:\Users\Admin\AppData\Local\Temp\252d5af9c304aa9a17b029f19e3c3cb2d113425cdb34fedb4ff65618103b1418.exe
"C:\Users\Admin\AppData\Local\Temp\252d5af9c304aa9a17b029f19e3c3cb2d113425cdb34fedb4ff65618103b1418.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
3KB

MD5
a47d0b7e05d051658681e35bc4430a7c

SHA1
ed0b5cc07970ce4b5ab3035acaf191bd366ecd72

SHA256
3e935379a5afd29e5676b1f9a6853255fd5fcb7508bfa086d2f2c9aa3da16ef9

SHA512
5b6f43efae5669fb44fb34da0a318dd8dbd48f2d06d21b390314960c23a22b6b657e37240ae093cb323a32ba2f8461158372e03b6374cd1e9119bd2c26e7b7b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
6KB

MD5
e519f07d0202571e04b4da5bd235b1a9

SHA1
bc7c463f968aa6bf5e9756b6482f92f9de3729b1

SHA256
9f7681ca61668169a7a710f84d53d00b58aeb0ba087de7b1e228f6f09cbd3249

SHA512
c0921263b0f78c6e6f849a94b5947a57768666cbcc227423f5ea8218346b41fd3b2adf891ddd2b5160c68d53e3fcb9a2d96edd53ff23ee5ac350e8a4aad1d1a2

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
1c4fb37d04aa8aeda505cd8ff1bef9cc

SHA1
159100f5a9e480679dd8f1394c5767832c6fa2d7

SHA256
8873f94ffb7fb4c755ec322ca05e3506a0a5990df35a2a5870da1a067c94cc17

SHA512
3eddcde82ee2021c8f3cc7dbe78baf94035b5f23750eb57c60218a288ab5432fa99885e379627ce9bd45f7e17bde1c69ddb30f2b26032ab12a25642685fdddbd

Download Submit