a1770c400f12938ea85cea85ed32acd014ca41e7906daed597a1d0c1b869d882

Analysis

max time kernel
140s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1770c400f12938ea85cea85ed32acd014ca41e7906daed597a1d0c1b869d882.exe
Size

44KB
MD5

33d3b2d015a8b72f8a894baa9c037a7c
SHA1

45b931dc2af0e2a23ef431aa5e4ae70d920db48e
SHA256

a1770c400f12938ea85cea85ed32acd014ca41e7906daed597a1d0c1b869d882
SHA512

0f4452dd576cfecfb5319db60202a5b7a5970d6ca43820e86c85ae0c35a35a6e2fc39f24726b3b871ccf565a1c709e2fd353acbd7cfbf2c429ea3dd4196d256a
SSDEEP

384:yBs7Br5xjL8AgA71Fbhv/Fzzwzep7ZsJRo5:/7BlpQpARFbhNIepj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1770c400f12938ea85cea85ed32acd014ca41e7906daed597a1d0c1b869d882.exe

C:\Users\Admin\AppData\Local\Temp\a1770c400f12938ea85cea85ed32acd014ca41e7906daed597a1d0c1b869d882.exe
"C:\Users\Admin\AppData\Local\Temp\a1770c400f12938ea85cea85ed32acd014ca41e7906daed597a1d0c1b869d882.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4948-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4948-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download