f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe
Size

481KB
MD5

814b050fa0fef363a44518840b84846f
SHA1

629d19678ee6b3ff85b0ae361e24c31bf9fbb568
SHA256

f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950
SHA512

9b9829a575d8ef0dc89f25ef7082d1c73806f9e7a6cbef76d7ee749ec2273ba7d7ad8be8c7f87caf6691ec159f4b85580edc53ef4aac867316e717fd89259955
SSDEEP

12288:NuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSR+DY:A09AfNIEYsunZvZ19Zqs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1664	f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe

C:\Users\Admin\AppData\Local\Temp\f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe
"C:\Users\Admin\AppData\Local\Temp\f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\registros\registros.dat

Filesize
184B

MD5
1d92346565d0d6a46f67612980f8077e

SHA1
7dff0dc140ae0c4f6283c7212a5d93cb76f72eaf

SHA256
298d8e9bfad70379541a93730811e19813c188a524751f888203c30f11613f93

SHA512
4356110b3d1b7a8ea4f713abe76a015b036ee8f45892a63d150100f54c9d5560c26d1f6a4608d3ac1480068a61b7442f7372e2fdb8dea497bdb4a3ee34378978

Download Submit