9818f5ae8db0a91f8375c40cf80c0ed333d92e2692babd57c2fcd35ec76a1218

Analysis

max time kernel
94s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninstall-查询1205.exe
Size

23.1MB
MD5

3b3c7f5a51c7f314c7d8f6e22c5261b7
SHA1

e52e72434b53dab50d9da6763bb5688bd0e87180
SHA256

d31bce852ae81b22853e8152abda04017c73d0acd2fb3027a5800a244d07f72e
SHA512

6917375bf8c810e8b73d8d11d2b25e5444b0f7711b5528a729128ca0ca22e040c9c237a5e5d9447f4c88b881aa1aa5a77ea9b7767d5ca79dcd68c5b6d2a0058a
SSDEEP

393216:cfEIHdtmFbNZwY5C82CUegQQVctb6A0CigulHbG0S8ZMvZ2:cHdkLuY5YCP06m/CbuBhfMvZ2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall-查询1205.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	uninstall-查询1205.exe

C:\Users\Admin\AppData\Local\Temp\uninstall-查询1205.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall-查询1205.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads