7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7.exe
Size

481KB
MD5

3d734d138c59dedb6d3f9fc70773d903
SHA1

e924f58edeff5e22d3b5d71a1e2af63a86731c79
SHA256

7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7
SHA512

d899ba3a6b0af1fa72032af41dab22d66385557305738ff181a6361c6f4f9f0d180bc65fa32297b022603b0f1c946b3c4a10ab2c6b7f780cd44d6e6213a2d53a
SSDEEP

12288:BuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSv+DY:k09AfNIEYsunZvZ19Zos

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4632	7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7.exe

C:\Users\Admin\AppData\Local\Temp\7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7.exe
"C:\Users\Admin\AppData\Local\Temp\7a16c7e55210e3bf2518d2b9f0bf4f50afe565529de5783575d98b402e615fb7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\registro\registros.dat

Filesize
184B

MD5
aa0766e63bafbd01890b23aa00590d87

SHA1
362009a15499db54066f0928ceb10018c0fd4965

SHA256
8411bd9896186c38dd29708e4deda647b245cb5d245eec4cff15321a518fca22

SHA512
6bca53db954fc0ce5ce44b3289e91691503a6c3c4154cdca351e04ae0b932ec3c043df2f07668b8cbb6cd83a14c1e5d2cefb962cb73f9042a13e5eafa89f3c7a

Download Submit