b9704486f48a5fa3a6b8febfca74d647add596f3abec2456bdf2249f803b4acd

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:04

Target

MalwareBazaar.exe
Size

482KB
MD5

1d5e255625ab9897dd332f78587a0fe7
SHA1

9c007b9e5ef34a8d07e69accd53acd8f352355a3
SHA256

b9704486f48a5fa3a6b8febfca74d647add596f3abec2456bdf2249f803b4acd
SHA512

957c8aa6d9312472761f2747d9ba7f91b7ffa33933581d983fd6b589349d171c8c6625f3c7046eaa69e99ed277aab6da51792c97a54d86e1cf5bbbf5673df12e
SSDEEP

6144:SXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZoAX0cN45Gv:SX7tPMK8ctGe4Dzl4h2QnuPs/Zo5cv

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

MalwareBazaar.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MalwareBazaar.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MalwareBazaar.exe

C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1016

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance