3e0665059d4b5e4a2275f5bcf1e7bde7dade9b71b7bc54e948a26d6c9eba17de

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e0665059d4b5e4a2275f5bcf1e7bde7dade9b71b7bc54e948a26d6c9eba17de.exe
Size

119KB
MD5

2960d83f88ef1c33b606b782d390f27c
SHA1

4a9221d0c0e386876d37079f613b4caa33c70532
SHA256

3e0665059d4b5e4a2275f5bcf1e7bde7dade9b71b7bc54e948a26d6c9eba17de
SHA512

993d9e39377fcd790a6ef3ab9e20c2fc8a9fe29cf754ec7d2fc52ad769fcc026a5bb49e7b27a7baddd215f80499dab8d24de62c4c7ddbe692c5fa3f0b039be55
SSDEEP

1536:/7ZQpApQKIKGJGTmXadjUSbcDemTPAZk+cLtdNlb9PfESDOayxaJG:9QWpQKIKGJG6W2QZwKS7w

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e0665059d4b5e4a2275f5bcf1e7bde7dade9b71b7bc54e948a26d6c9eba17de.exe

C:\Users\Admin\AppData\Local\Temp\3e0665059d4b5e4a2275f5bcf1e7bde7dade9b71b7bc54e948a26d6c9eba17de.exe
"C:\Users\Admin\AppData\Local\Temp\3e0665059d4b5e4a2275f5bcf1e7bde7dade9b71b7bc54e948a26d6c9eba17de.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2772-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download