b1b307452d1dc1bf98be46dbef02a917d569938b49032da7cc91b7740978a83a

Analysis

max time kernel
140s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 00:51

Target

b1b307452d1dc1bf98be46dbef02a917d569938b49032da7cc91b7740978a83a.exe
Size

628KB
MD5

7ec3ffa14214b58a95893c1a03c29d79
SHA1

4f98addc80faadb8bf5c6053e7419b12236b0e7a
SHA256

b1b307452d1dc1bf98be46dbef02a917d569938b49032da7cc91b7740978a83a
SHA512

a018f0e77bde3c7a1f8dde4dc0230c85128c55f60d239318ceddd34a9cabb4b50c69381642116ab7d04fbcc25e0368d920c97ef16b588893be4bea1815fd3ac9
SSDEEP

6144:t5FdA9+3bkRQIwYEgRy2k46fifqlhyBQLzaWS5T3nxyhXf:tvdA9SGh9rBylQB4at1nxs

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

Processes:

b1b307452d1dc1bf98be46dbef02a917d569938b49032da7cc91b7740978a83a.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1b307452d1dc1bf98be46dbef02a917d569938b49032da7cc91b7740978a83a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b1b307452d1dc1bf98be46dbef02a917d569938b49032da7cc91b7740978a83a.exe

pid process

2168 b1b307452d1dc1bf98be46dbef02a917d569938b49032da7cc91b7740978a83a.exe

pid	process
2168	b1b307452d1dc1bf98be46dbef02a917d569938b49032da7cc91b7740978a83a.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2168-0-0x00000000022F0000-0x00000000023E1000-memory.dmp

Filesize
964KB

Download