f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe
Size

481KB
MD5

814b050fa0fef363a44518840b84846f
SHA1

629d19678ee6b3ff85b0ae361e24c31bf9fbb568
SHA256

f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950
SHA512

9b9829a575d8ef0dc89f25ef7082d1c73806f9e7a6cbef76d7ee749ec2273ba7d7ad8be8c7f87caf6691ec159f4b85580edc53ef4aac867316e717fd89259955
SSDEEP

12288:NuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSR+DY:A09AfNIEYsunZvZ19Zqs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4612	f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe

C:\Users\Admin\AppData\Local\Temp\f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe
"C:\Users\Admin\AppData\Local\Temp\f577afbcb05a47c037abb081c6146d620b4ec9b428988e235dc10fa0f5665950.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\registros\registros.dat

Filesize
184B

MD5
a78fdf593b0e189086e25dc4668488bd

SHA1
eeaaeac5f7730468b541a57c997a3e079df96944

SHA256
07694c12356e4129552191391415172ef61074f42ebc92be833b62b630abdf2a

SHA512
335b90ccbdd99fad9bbbeaf786a1c8b6ab69bd74bf8f8df72d87f77b3e521639efa965ce0db6f4b3a855922c2f0fb77e5c5932263e532cd760c53352a1c65d84

Download Submit