f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe
Size

481KB
MD5

814b050fa0fef363a44518840b84846f
SHA1

629d19678ee6b3ff85b0ae361e24c31bf9fbb568
SHA256

f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950
SHA512

9b9829a575d8ef0dc89f25ef7082d1c73806f9e7a6cbef76d7ee749ec2273ba7d7ad8be8c7f87caf6691ec159f4b85580edc53ef4aac867316e717fd89259955
SSDEEP

12288:NuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSR+DY:A09AfNIEYsunZvZ19Zqs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3484	f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe

C:\Users\Admin\AppData\Local\Temp\f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe
"C:\Users\Admin\AppData\Local\Temp\f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\registros\registros.dat

Filesize
184B

MD5
e68e1f031c92e07d6fd9421411842420

SHA1
cafebe54f9e1aa003f904b665b143b3cfd537ce8

SHA256
18f89ca5769f9f37394a04d20b0741b7477a6848f5570bdecd3b8f8c3641a8e5

SHA512
2110d3ba5d4b7d7fedfe5e0be1f8043d3eabbfa856cbf2abd41c4673208c6b9e50b0a14aca1e56819c70cfffcac913e7ee73a9eac06390cc1028ef3b48fa0f6a

Download Submit