6e55caedc91f3465d0594681a1abe6fd3aaffabde64a26eaed1d0e228de59db6

Analysis

max time kernel
94s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AKV.exe
Size

457KB
MD5

46ccfd974518e5849738449034a05a17
SHA1

d391108816aed7ba8f7beb205ad7171c74eae6b2
SHA256

571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe
SHA512

773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a
SSDEEP

6144:y3CPF9R/a4bR55krSGKLFLtqWwxSnvAHc/0QR86ll8h/9VGC9HK:l/agR0rSGKBLtPMEvAHL2lr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AKV.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1756	AKV.exe

C:\Users\Admin\AppData\Local\Temp\AKV.exe
"C:\Users\Admin\AppData\Local\Temp\AKV.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-0-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/1756-1-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download