7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7.exe
Size

481KB
MD5

3d734d138c59dedb6d3f9fc70773d903
SHA1

e924f58edeff5e22d3b5d71a1e2af63a86731c79
SHA256

7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7
SHA512

d899ba3a6b0af1fa72032af41dab22d66385557305738ff181a6361c6f4f9f0d180bc65fa32297b022603b0f1c946b3c4a10ab2c6b7f780cd44d6e6213a2d53a
SSDEEP

12288:BuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSv+DY:k09AfNIEYsunZvZ19Zos

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4888	7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7.exe

C:\Users\Admin\AppData\Local\Temp\7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7.exe
"C:\Users\Admin\AppData\Local\Temp\7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\registro\registros.dat

Filesize
184B

MD5
0e21ef6fc9e807a423d31a41529ca1a0

SHA1
85283ba66a79d67226c41e1c9618990177d3b211

SHA256
4f9ac7c2a8c6faa6120ec6c20d19ae69ff6fbe0d85f71252cd516bcc8780ad83

SHA512
d867f5817822e84599b04cfb02b5ec476c84dd772f201910a6296cdcffd785de31a55bcf99c3c33abe259e8ed5fe7d35bae3e1a5c54a5dbc986470a3b9d0af22

Download Submit