b9cdc60586f0ba16468d7a4a62a30d4c745d283919ecc94b7a08eaa560def688

Analysis

max time kernel
1300s
max time network
1141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 16:33

Target

standalonephase1.exe
Size

54KB
MD5

eb339eecec8aa8c0fd3b08d39799d4d8
SHA1

860efd5893e4dd4e820227b7dead144f974456ac
SHA256

88bb94c3ce727db13b77abdbdb75a4c878e91d651692f3618178dec5bbb7080c
SHA512

bc29778386853f2340eb2e58be9ae3c64e2f8a1df5f7301fdd06c42e3ef2463bea9c8e854d58d912d444f2c2e24f9541fb3715f0cb5f50fa89eafcec6bba87fa
SSDEEP

768:IlSyUIeWkNgcT1+z/9ADX38J8u46Z09XPe+vpgEGfk6rAlpdej5fe6di:0Jdu+D9Ar38f46ZcPe+vpgE6AC5fe

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

standalonephase1.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language standalonephase1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	standalonephase1.exe

C:\Users\Admin\AppData\Local\Temp\standalonephase1.exe
"C:\Users\Admin\AppData\Local\Temp\standalonephase1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2952

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance