71971d782125679e1c4d528e1ffdba435e92c570cf22690a83fe9cb0fca5bfeb

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06-02-2025 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f792059834427eb907c412d0a0efd0c599126088779bcf2daa9762af55d0d97e.exe
Size

469KB
MD5

cb21cf3e8992ce458ad2e763ecc2a8e0
SHA1

3d233e2b782da7135dda6a07dd835ddbb70152a4
SHA256

f792059834427eb907c412d0a0efd0c599126088779bcf2daa9762af55d0d97e
SHA512

896e2833fa2b31ae086c1680c8bd53a5aee2bd45ab614bea0e62703086b756ab43aee328dfe77b2659059ccd096a37963ccf6185ecb28651082f296d514b6a1e
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSTn9:uiLJbpI7I2WhQqZ7T9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f792059834427eb907c412d0a0efd0c599126088779bcf2daa9762af55d0d97e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2136	f792059834427eb907c412d0a0efd0c599126088779bcf2daa9762af55d0d97e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2136	f792059834427eb907c412d0a0efd0c599126088779bcf2daa9762af55d0d97e.exe

C:\Users\Admin\AppData\Local\Temp\f792059834427eb907c412d0a0efd0c599126088779bcf2daa9762af55d0d97e.exe
"C:\Users\Admin\AppData\Local\Temp\f792059834427eb907c412d0a0efd0c599126088779bcf2daa9762af55d0d97e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ios\logs.dat

Filesize
230B

MD5
bd99f58d07a5993c414922ef840465f7

SHA1
d06e4e1371906c2a6b59291657820c0aea8e8601

SHA256
23ed94126ce12067dc5db5ac486fd91cfd49c750f0019c359fe73f0825949dea

SHA512
75934239607e87139b40517e801eeac6d3fd25b6d7b374acf467b486adb5dd463d2f1400ad132e92d6fdc29d069c5902c53899014910fac8f49505102f5bf003

Download Submit
C:\ProgramData\ios\logs.dat

Filesize
144B

MD5
945ec3989127b3558027fce701ea3e37

SHA1
bb27374817a9a5e065aa7fe80c8de72a27242fcf

SHA256
9160f2c9230bb3db69e36fac7e34ece8277865a25af1fd2577a2108c83ca6ca1

SHA512
4900d4fb5295b5e76d0f7f2b92b4bb32189e6083607e0c385c477141db2a75a90ff8cc5b2957a01e12b3e8cb6c85a01532369b70ebf0ff1e3220ced2dccd2f2b

Download Submit