f92ad1e92780a039397fd62d04affe97f1a65d04e7a41c9b5da6dd3fd265967e

Analysis

max time kernel
1363s
max time network
1159s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 20:59

Target

lib/insdrv.exe
Size

12KB
MD5

b32d29447b5a7a4b8e62f7df5efec272
SHA1

4cf32f4a969f62e8c580be3641748b4832397811
SHA256

1cd0c2ba5eeaf5519055924f049a4c7feae999126a7c81a16961e486902a1bad
SHA512

f26e3e9e9bb3700422843a54a3ef45dcda7073f1af2c36c105f88a6ccead4b4931007341e58f468b4481b676e713c708e3f7aa27360a86599ad7dc01e26b91e6
SSDEEP

192:HI4SGHjM9zdjKgOMNhbwi5BlLot6OnTVYy78b55Tl/QJEu7aPHAVIb/K:oVUM9RegOMrbwVtzTNuTKb7aPTu

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

insdrv.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insdrv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	insdrv.exe

C:\Users\Admin\AppData\Local\Temp\lib\insdrv.exe
"C:\Users\Admin\AppData\Local\Temp\lib\insdrv.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1068

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact