b86bcee73c65b50d5a86976c855aca8ebe7542f7fb983ea7b6c9ef5b69456d18

Analysis

max time kernel
121s
max time network
138s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
27-07-2024 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Battlefield 2/NavMesh/ROBOCOPY.exe
Size

179KB
MD5

654ecd8cf8b6179854509a1b4bacd78f
SHA1

c95a0373572a3a8063d3d3b8becf275fc775ccf1
SHA256

f9d4547690b0b77f24906f9145428d5745c47943948afcc897ea6b27664571f6
SHA512

ab6897c0cc5485cc4a765fcf4635aa9d91c2423fe07533f8d9a4fb3699c8053498187b5b56416f0176c73d7a6fd9b9017a9a8beb9173ae349e0dcb41a68b8018
SSDEEP

3072:NHrelz/7xIsS19t8b3ZfCVCC3pBHgmyvgjWBgd3013Y8GncGq:B6J7xpg8b3ZfUHHuvAw2RI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROBOCOPY.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	3280	ROBOCOPY.exe
Token: SeRestorePrivilege	3280	ROBOCOPY.exe
Token: SeSecurityPrivilege	3280	ROBOCOPY.exe
Token: SeTakeOwnershipPrivilege	3280	ROBOCOPY.exe

C:\Users\Admin\AppData\Local\Temp\Battlefield 2\NavMesh\ROBOCOPY.exe
"C:\Users\Admin\AppData\Local\Temp\Battlefield 2\NavMesh\ROBOCOPY.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads