09e65a661e85c3a3ab0e848809e44f20332b9f46cf5da364c7c8d3992c957f85

Analysis

max time kernel
90s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2024 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HelpUtility.exe
Size

148KB
MD5

c678f2c86400aa2c2e7c4782ad19c652
SHA1

f9d6d3ede05a597d7c362704dc03a3eb82a445d3
SHA256

37839cf5c7018440bab9b8d41436fabb69ab93a90e2e0eef01d565013e208ad8
SHA512

790d76f98543ca52f06dc4c80cb42ae954daba4eee89a06d8dad65fab7d807b92b6a7cefdef685f2ae161bcbc15ffb8b271408ee60cb2e61468b7f00a3e0a270
SSDEEP

3072:CSiN9E5e6zYYtEuk8Uu93C7aWoHWoFbW3JB0bO16O1fnzl:CSiGzV5LZLbGvz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpUtility.exe

C:\Users\Admin\AppData\Local\Temp\HelpUtility.exe
"C:\Users\Admin\AppData\Local\Temp\HelpUtility.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads