f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/12/2024, 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe
Size

481KB
MD5

814b050fa0fef363a44518840b84846f
SHA1

629d19678ee6b3ff85b0ae361e24c31bf9fbb568
SHA256

f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950
SHA512

9b9829a575d8ef0dc89f25ef7082d1c73806f9e7a6cbef76d7ee749ec2273ba7d7ad8be8c7f87caf6691ec159f4b85580edc53ef4aac867316e717fd89259955
SSDEEP

12288:NuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSR+DY:A09AfNIEYsunZvZ19Zqs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1928	f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe

C:\Users\Admin\AppData\Local\Temp\f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe
"C:\Users\Admin\AppData\Local\Temp\f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\registros\registros.dat

Filesize
184B

MD5
1829ba78f57d92a59aec68bbed0b093f

SHA1
049dde15dc4f3bf7955ad95923c8d099861b71d8

SHA256
ddb840235699b26fe212e8df16019ba66adabe3859fa34c94fbda01af34e9769

SHA512
49a60f34498a85bff13ffe0519b77efe4d91c9cbc22f1a7d721c3397a1311ecb64d3e27743f44ff1039ea3d9c5a3be5332aee69c44a47b5622f530e24483621e

Download Submit