a27308740e4a7a558479b521d4beb495b6e165ac86e35ea7d90d7ce81542bfcf

Analysis

max time kernel
118s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a27308740e4a7a558479b521d4beb495b6e165ac86e35ea7d90d7ce81542bfcfN.exe
Size

468KB
MD5

e2e22aa7242dab80520b6f570859f5d0
SHA1

a6f457fe2a097dc834450fb489bb669de0e7f91e
SHA256

a27308740e4a7a558479b521d4beb495b6e165ac86e35ea7d90d7ce81542bfcf
SHA512

caf8aa2ee3dd0ba3567fce5b12cb3963dbda72278d9680309c3de4c9425950c48c69856eebb2c305ba242c0c7d866522c229cfd5ca7498ed8ed0e82350f78fbc
SSDEEP

3072:98a/o3clIV3KhbYDPz5jNfT/rkhMPIpmnOHC/V1nfkGp3FWNShlb:98+oF9KhwPtjNf30ADfke1WNS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a27308740e4a7a558479b521d4beb495b6e165ac86e35ea7d90d7ce81542bfcfN.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
780	a27308740e4a7a558479b521d4beb495b6e165ac86e35ea7d90d7ce81542bfcfN.exe

C:\Users\Admin\AppData\Local\Temp\a27308740e4a7a558479b521d4beb495b6e165ac86e35ea7d90d7ce81542bfcfN.exe
"C:\Users\Admin\AppData\Local\Temp\a27308740e4a7a558479b521d4beb495b6e165ac86e35ea7d90d7ce81542bfcfN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-51942.exe

Filesize
468KB

MD5
d3667c88eddb45e5dfdba6f2363a4343

SHA1
23d89115d725f4168c5d35cfe2a6f3866bfeb372

SHA256
7ed6ad4cdc2a37d589fe9ef4d8344cf29f6284e277a4a24dc2fdd1d5a4e8e69c

SHA512
2415ee306b159dfa4cd021e2e7749a505517746413e2fc1e073993227cf7cbbf54b33ec572b58ff065ad6f551547eb9b5d447c3d6bc1ea03e8aa84959c58991c

Download Submit