7dbbe22946c2437845591d5bcbddcc550a8bb16c8dba01e13e34cd52f3fc7c36

Analysis

max time kernel
136s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/minibar.exe
Size

468KB
MD5

16095be07798719a78e3ea1bffa16598
SHA1

f3f534cd840381d5c882b50a2c7d29d48a567c02
SHA256

f036edda3c9b41ddaa2950e475f63b59183bc040eba436a7d369a46bf4304b63
SHA512

327cac6d56bb834adaa3ab953df093dea274da355ac5ba916170be9c99bf0b8348c0bbe83857b78162bcf409e719af2ecce9303bb435d7f20b1fd1367becb586
SSDEEP

12288:7Cog8XMjQnPzj+eKqsZ02ryZjVkI+EDBf6ZH1aH:7C7onPzj1sKTZj6I+ifUHS

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	minibar.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\minibar.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\minibar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...