b5d6cb76c465991419c4b4d3b94551f357e0b1035fed1ec20b60b6c38614c90f

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e77591479d57c7fa2856a7922eed4c0N.exe
Size

70KB
MD5

2e77591479d57c7fa2856a7922eed4c0
SHA1

e5580f169a05adbc57c978a4f6edc3dcfeae1745
SHA256

b5d6cb76c465991419c4b4d3b94551f357e0b1035fed1ec20b60b6c38614c90f
SHA512

6a0e36051d24ba6a6b7592d8818a07414ea20086af71f920c6c2f8d1705519de9165778e6fa8c19c5c6896d007e4cfb7e0337e6effac17d9652e03c90a328a4c
SSDEEP

1536:YvKqZZQs1ShQi7+20biLiRVYUroC42zqUHfTamOg9wbLy:YvZx1UGViLiRVY72mU/TamH9ey

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e77591479d57c7fa2856a7922eed4c0N.exe

C:\Users\Admin\AppData\Local\Temp\2e77591479d57c7fa2856a7922eed4c0N.exe
"C:\Users\Admin\AppData\Local\Temp\2e77591479d57c7fa2856a7922eed4c0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\My Downloads\Prisoner Of War Key Generator.exe

Filesize
70KB

MD5
2e77591479d57c7fa2856a7922eed4c0

SHA1
e5580f169a05adbc57c978a4f6edc3dcfeae1745

SHA256
b5d6cb76c465991419c4b4d3b94551f357e0b1035fed1ec20b60b6c38614c90f

SHA512
6a0e36051d24ba6a6b7592d8818a07414ea20086af71f920c6c2f8d1705519de9165778e6fa8c19c5c6896d007e4cfb7e0337e6effac17d9652e03c90a328a4c

Download Submit
memory/2432-100-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download