d8fdce8b72aff868104da9960c4302ca828007b35827443fbaa20a16c9f07a09

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d8fdce8b72aff868104da9960c4302ca828007b35827443fbaa20a16c9f07a09.exe
Size

69KB
MD5

41bbea0cb40f5ed522e83d26720f55b0
SHA1

3a99ebc0af5d20b8be09c3f060f72b4f57fb7014
SHA256

d8fdce8b72aff868104da9960c4302ca828007b35827443fbaa20a16c9f07a09
SHA512

713bb3e580988ec07a65b2ce9bdcfed44df122710598d89da53348c1681ae92686a878bb3c68688aa01196fe598e1071526b2899b7e6d47ace321aff79b064e7
SSDEEP

1536:ovKqZZQs1ShQi7+20birvqHiRVYuRpC8w1QObFy6jfV:ovZx1UGtiWHiRVYgpzw17bRTV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8fdce8b72aff868104da9960c4302ca828007b35827443fbaa20a16c9f07a09.exe

C:\Users\Admin\AppData\Local\Temp\d8fdce8b72aff868104da9960c4302ca828007b35827443fbaa20a16c9f07a09.exe
"C:\Users\Admin\AppData\Local\Temp\d8fdce8b72aff868104da9960c4302ca828007b35827443fbaa20a16c9f07a09.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\My Downloads\KaZaA Media Desktop v2.5 UNOFFICIAL Patch.exe

Filesize
69KB

MD5
41bbea0cb40f5ed522e83d26720f55b0

SHA1
3a99ebc0af5d20b8be09c3f060f72b4f57fb7014

SHA256
d8fdce8b72aff868104da9960c4302ca828007b35827443fbaa20a16c9f07a09

SHA512
713bb3e580988ec07a65b2ce9bdcfed44df122710598d89da53348c1681ae92686a878bb3c68688aa01196fe598e1071526b2899b7e6d47ace321aff79b064e7

Download Submit
memory/1752-100-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download