8b9147aeca757bc36f30e98c7481ec302d2be6de1b893a6f2ad80864f1106fb3

Resubmissions

03-08-2024 19:46

240803-yg8nestbqr 10

03-08-2024 19:44

240803-ygbcxsxhld 6

03-08-2024 19:41

240803-yd6pnaxgpa 6

Analysis

max time kernel
1794s
max time network
1799s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

win-airplay/Blueberry-Airplay.exe
Size

463KB
MD5

d8b60b34a2ba716d06ccd41716e330e2
SHA1

2ee2007f61e93a81aada7e875e08c50c0b85c2e7
SHA256

02e38cf1932bab2cd485234b0b4442c413d6518203d806988f432856f979fc8a
SHA512

f903f78c287d45cef8bf2b2865d9265fc447a4ea2b1ad56b2dc2c59811ebdcc49bc64aa68049a61677fa35826d46da6337936dfb4b44b127e731532b440e5d33
SSDEEP

6144:i1z7j62HxsgYZhWR42gGn2So70wS9qaYTGAU+GL+3H:gfoGto70/gP3H

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Blueberry-Airplay.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blueberry-Airplay.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blueberry-Airplay.exe

C:\Users\Admin\AppData\Local\Temp\win-airplay\Blueberry-Airplay.exe
"C:\Users\Admin\AppData\Local\Temp\win-airplay\Blueberry-Airplay.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:8
1⤵
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4072,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads