28eab73a27ae9f4a17179739d7c49fb3d6e7fb34926225a4f10884b2eac4a20d

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28eab73a27ae9f4a17179739d7c49fb3d6e7fb34926225a4f10884b2eac4a20d.exe
Size

14KB
MD5

c66fc6e6fd1acdb83ec26e0256b55af4
SHA1

e9b69ee9309c6243222766e975fe40b02c8a3bf1
SHA256

28eab73a27ae9f4a17179739d7c49fb3d6e7fb34926225a4f10884b2eac4a20d
SHA512

36ccef2a256b3970970f46223e5f4d24887e53e335f1e58de0237d4050b1954f2fd01e9faf9d1c21ca66fe412f98f0eb83def5100863881f1d4c5c3a2857b20c
SSDEEP

192:dPgM8cRIxbIEw3asz0sWaKRI+IrYy9SJETW5G890mqnEhU6i5fRf2POLJYNP5qJS:dYpcRFh0ZaKGSJgl7ES35fl2yYNha+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28eab73a27ae9f4a17179739d7c49fb3d6e7fb34926225a4f10884b2eac4a20d.exe

C:\Users\Admin\AppData\Local\Temp\28eab73a27ae9f4a17179739d7c49fb3d6e7fb34926225a4f10884b2eac4a20d.exe
"C:\Users\Admin\AppData\Local\Temp\28eab73a27ae9f4a17179739d7c49fb3d6e7fb34926225a4f10884b2eac4a20d.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download