f828561f75ee664450e1aac29256aa0aff6bd349232f98d33048dde78c0962bf

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2025, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17389194640a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86682.dat-decoded.exe
Size

469KB
MD5

87f462061a7d16962f60ce5e3fc2ac05
SHA1

ee32f10df48b2989da006c198cb1593ff503ea30
SHA256

f828561f75ee664450e1aac29256aa0aff6bd349232f98d33048dde78c0962bf
SHA512

6580a27471c95162ae03af16f3c2e9968ee200b29be710d45e7a791f308c5dc271699242d95740798b8626cd87ca69218a9601f5b6f247d16278826da42ddbac
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSen9:uiLJbpI7I2WhQqZ7e9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17389194640a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86682.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4884	17389194640a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86682.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\17389194640a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86682.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17389194640a75498800959210a5e2dc4e4a54ef8f97997861d794a065114c5234e6d4ed86682.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\smss\logs.dat

Filesize
144B

MD5
6303702e410eb95fd1d2ef555bcb0c57

SHA1
3a9e2d6fa327fed196fc1d549ba5791a326187d8

SHA256
37441fa4e3395f6446b4e2765e7ca7ccd12cade1e346061832273da95646d507

SHA512
9fa27118eec8f8413eac0aa3aea33b2c1e009bbc1f1649a3671b77adeb0d8eeb463f7342b7ad9dec06580fce852acb9ed15231820d9b03b8c121937d434c0c55

Download Submit