2bdf894b05844e6ce24c7a42eaf3abae2312b094d1277db0a09bc83a8fef886a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/UXTheme Patcher.exe
Size

72KB
MD5

c35efaa15f6f1da888efc247e886389d
SHA1

e3f35519380a564ff62f5ea2fa95fd5bca38bb1a
SHA256

558f6e38c300957234231234c44ccf41217182677e859c9005a51094bdf01794
SHA512

fd3d27271cab60f51929a4e92cccd0ce2edf8c95fd2db6cc957620ff2f7522e644b67862ec7803e6068f5ae75caedad9daae3dafdd4b7f4898c618c8498dca16
SSDEEP

1536:oI78vwnEmMpryYRt2M5d3YieAB3iW+IalC6L9XMI+l1+hX:/78vwnEm+1RAkd3deANZ+IoC6xXMIYg1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

UXTheme Patcher.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UXTheme Patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

UXTheme Patcher.exe

pid	Process
820	UXTheme Patcher.exe
820	UXTheme Patcher.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads