d7bcf0bfea865472381f04382651897a3aec9980425375b8058582df6cf5d66a

Analysis

max time kernel
142s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7bcf0bfea865472381f04382651897a3aec9980425375b8058582df6cf5d66a.exe
Size

119KB
MD5

9d18bebe866eecf054852200209d9a04
SHA1

5a33968ee87988c77bb5b9bf239b8fee3d2d2520
SHA256

d7bcf0bfea865472381f04382651897a3aec9980425375b8058582df6cf5d66a
SHA512

f100caf97e593b3c3a1f0e91ac0f05adec0b725d27ceebee2493950606ed6f835eb76971832b2b3f19e2839efa02ff5ead1829e6557c11d875e5f7468c4ad963
SSDEEP

1536:W7ZppApFJymJy4TmXadjUSbcDemTPAZk+cLtdNlb9PfESDOayxaJr:6pWp76W2QZwKS79

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7bcf0bfea865472381f04382651897a3aec9980425375b8058582df6cf5d66a.exe

C:\Users\Admin\AppData\Local\Temp\d7bcf0bfea865472381f04382651897a3aec9980425375b8058582df6cf5d66a.exe
"C:\Users\Admin\AppData\Local\Temp\d7bcf0bfea865472381f04382651897a3aec9980425375b8058582df6cf5d66a.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...