f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2024, 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe
Size

481KB
MD5

814b050fa0fef363a44518840b84846f
SHA1

629d19678ee6b3ff85b0ae361e24c31bf9fbb568
SHA256

f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950
SHA512

9b9829a575d8ef0dc89f25ef7082d1c73806f9e7a6cbef76d7ee749ec2273ba7d7ad8be8c7f87caf6691ec159f4b85580edc53ef4aac867316e717fd89259955
SSDEEP

12288:NuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSR+DY:A09AfNIEYsunZvZ19Zqs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
848	f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe

C:\Users\Admin\AppData\Local\Temp\f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe
"C:\Users\Admin\AppData\Local\Temp\f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\registros\registros.dat

Filesize
184B

MD5
61e53f08412ab3a210426442be220b92

SHA1
24e0c7cfa5493efd7f2a69816a6a7d2fd078a581

SHA256
10bb157e0f817e91ca5a20d7276222fb7e093894817fb0a4c03faf2780c16846

SHA512
3a58470e63c03265f8ad10c36fb2ed4f7199d7c304e55ac4ff0e10bed083cbff3b474209990e4166fe47d3d9ddf3ec218fe57f24935833ca4de57088003b75ae

Download Submit