68a978d79c28dbc77bb7b7d24e45068d295814894f443b945fd2972b3029649d

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68a978d79c28dbc77bb7b7d24e45068d295814894f443b945fd2972b3029649d.exe
Size

7.9MB
MD5

9c647029eba7a6d7f8562afe8b6a88a1
SHA1

661d944e65cd0ab04ca634fb246554feaf61c7c3
SHA256

68a978d79c28dbc77bb7b7d24e45068d295814894f443b945fd2972b3029649d
SHA512

4f25dbdcd6a8c6245c997a30603c9823e87f2ca4c3465ebd0c4ff3ff5905a056f08265b3a0dc1724d47b9aab117cc87d769799d462b236f9da311d840a278ae5
SSDEEP

98304:Xg49ZaYwsmJdj9PfPHRCjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafD:XgP34NTx9Pe20/zkOiu1f+79YRck

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2944	68a978d79c28dbc77bb7b7d24e45068d295814894f443b945fd2972b3029649d.exe
2944	68a978d79c28dbc77bb7b7d24e45068d295814894f443b945fd2972b3029649d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68a978d79c28dbc77bb7b7d24e45068d295814894f443b945fd2972b3029649d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2944	68a978d79c28dbc77bb7b7d24e45068d295814894f443b945fd2972b3029649d.exe

C:\Users\Admin\AppData\Local\Temp\68a978d79c28dbc77bb7b7d24e45068d295814894f443b945fd2972b3029649d.exe
"C:\Users\Admin\AppData\Local\Temp\68a978d79c28dbc77bb7b7d24e45068d295814894f443b945fd2972b3029649d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
14fa6413cf6ac2e9a804571a9c628629

SHA1
f8677b7f9a8b31c539455d3ef8067b6d2fdf45c5

SHA256
9d772549ae7ab2a85167ffb037db2400c8215ef8e621fd67d6b447f059db6c0f

SHA512
86a31c50d4054d74b2406ba37838fab5f859f1302a4236167c42c60582d36fa87e10fd0538405e3ad307c35ce3d6df52785258c482684b9c907fde441247b46c

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
c9b470330cf88a82b55c642037a6b344

SHA1
d8fe731d9eec70f961a523f4927f257dd1367e74

SHA256
834d9d67d95c366f29d15efaadcf9ecd3234b640b370f997cb801c3077dc44ff

SHA512
72a5c0e8f0fd08c1dbe397a205cf564efa7c01ba209f78ce46928959d44ebbc6df0785462dac243fe98bc898512e466d18db0c552c69b6443adf357d09d69062

Download Submit