fa1431dcfab56cd40f4ed37f8859aad81e2826d6df2888a4a58fa54c3ae2d76f

Analysis

max time kernel
141s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-10_655859b312973e89bf8c0efb309851e4_bkransomware.exe
Size

137KB
MD5

655859b312973e89bf8c0efb309851e4
SHA1

b5d6e037dbf7edc60cc13be9ecef83069f66b1d5
SHA256

fa1431dcfab56cd40f4ed37f8859aad81e2826d6df2888a4a58fa54c3ae2d76f
SHA512

2416394f7fbd33c7e0675e595a7eb1a8d506e6cd1c0479531b5b5c200db5b040256995ada311d7c4c22639828d3f18a07d685e74d5e4d0c2e67be7a0750eae87
SSDEEP

1536:e2YoP0020soVrLmVKK5FRNsu0SNcdIeteI+v6qbyhvyi9rI1Hc8EisWjcd9feJ/j:JYoM02XoVmcSCauIRtnEN9feJ/t1j

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-10_655859b312973e89bf8c0efb309851e4_bkransomware.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-10_655859b312973e89bf8c0efb309851e4_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-10_655859b312973e89bf8c0efb309851e4_bkransomware.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...