5e6bf20a9e2b38c2398c5b0dbe760e30f87d216b23939b703df3f9eafe9dcd49

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c77ed3353395b4b79b59efd021e4d420N.exe
Size

479KB
MD5

c77ed3353395b4b79b59efd021e4d420
SHA1

8e2ead8aa8ff44d33fb9761a67de56922b993858
SHA256

5e6bf20a9e2b38c2398c5b0dbe760e30f87d216b23939b703df3f9eafe9dcd49
SHA512

e5fdc39d58072ad28e187620e643ab81951a0a79f734501e821e985bfce2283a4894584488fc912abc429451c63939287950c956f4a39b522ff9b8b5f1ddbd8d
SSDEEP

12288:Bhxt+m0wClEGsx65H+FwVUCyz5ixlqovP:BhHptClL5HowozW/v

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c77ed3353395b4b79b59efd021e4d420N.exe

C:\Users\Admin\AppData\Local\Temp\c77ed3353395b4b79b59efd021e4d420N.exe
"C:\Users\Admin\AppData\Local\Temp\c77ed3353395b4b79b59efd021e4d420N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-0-0x0000000000401000-0x0000000000476000-memory.dmp

Filesize
468KB

Download