f752893bf6b8a529a01142abea8b678468579ef28677acd4bdb43b859d2c61b9

Analysis

max time kernel
110s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01781ca1321dd5d2df6735fb689cc390N.exe
Size

156KB
MD5

01781ca1321dd5d2df6735fb689cc390
SHA1

fa66d09e2f6efd91702d11cad44838257f4fbf1b
SHA256

f752893bf6b8a529a01142abea8b678468579ef28677acd4bdb43b859d2c61b9
SHA512

ac6113051ea2d06a45aa4e0bd78451b7237aa274466558a38b1f1947ab5c9020128dc2cb6e5a5d1de1b0839de65be7c49b70e1e3b36a5f5076150edf9e9964dd
SSDEEP

3072:1s3o8A4M3riN6MhGkgS3PL67n5OkhBOPC/P/FnncrK:1DeM7iNEkgi81EC/Jd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01781ca1321dd5d2df6735fb689cc390N.exe

C:\Users\Admin\AppData\Local\Temp\01781ca1321dd5d2df6735fb689cc390N.exe
"C:\Users\Admin\AppData\Local\Temp\01781ca1321dd5d2df6735fb689cc390N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4028-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4028-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4028-11-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download