f828561f75ee664450e1aac29256aa0aff6bd349232f98d33048dde78c0962bf

Analysis

max time kernel
147s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/02/2025, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17389194640a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86682.dat-decoded.exe
Size

469KB
MD5

87f462061a7d16962f60ce5e3fc2ac05
SHA1

ee32f10df48b2989da006c198cb1593ff503ea30
SHA256

f828561f75ee664450e1aac29256aa0aff6bd349232f98d33048dde78c0962bf
SHA512

6580a27471c95162ae03af16f3c2e9968ee200b29be710d45e7a791f308c5dc271699242d95740798b8626cd87ca69218a9601f5b6f247d16278826da42ddbac
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSen9:uiLJbpI7I2WhQqZ7e9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17389194640a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86682.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2380	17389194640a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86682.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\17389194640a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86682.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17389194640a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86682.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\smss\logs.dat

Filesize
144B

MD5
1bcb1a26c5700a9221a8f0c00b2ace03

SHA1
91b58da36314c63092f6a03021591faab9fa47eb

SHA256
82dbdc5219563e2eebe73e4835016ddc25a33493241d5d41173efbdcc715dcd6

SHA512
10aac039b175761527bdd124b1c4737d70c82a0904e6454d066d3231513c190c826bbc574d1768c19aac99791a9ccd2e1c903f7e43213f8c650708de0a6f9209

Download Submit