838ac92610147408c850191dc4d38af831391eb0013ee1342bd9a73079f632ff

Analysis

max time kernel
138s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240802-fr
resource tags

arch:x64arch:x86image:win11-20240802-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
07-08-2024 18:56

Target

ProtonVPN-10_11/data/appInfo/services/wget.exe
Size

4.9MB
MD5

8c04808e4ba12cb793cf661fbbf6c2a0
SHA1

bdfdb50c5f251628c332042f85e8dd8cf5f650e3
SHA256

a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272
SHA512

9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f
SSDEEP

98304:bHObnQdOb3OWEqNHeHq6PdOnS8SOGdVilQeHPpXF0aGOVxuGqYE6hpAl/70pzd+Z:bHInQ5WE2HeHq61OJSOGdVilQeHPpXFA

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

Processes:

wget.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe

C:\Users\Admin\AppData\Local\Temp\ProtonVPN-10_11\data\appInfo\services\wget.exe
"C:\Users\Admin\AppData\Local\Temp\ProtonVPN-10_11\data\appInfo\services\wget.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3552

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3552-0-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download