6ad1835f4a03f110b2094ede277a362ccb36bef8613bffb0a07380e3a666f18c

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12-08-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

engine/freshclam.exe
Size

187KB
MD5

f226a6bd7d10a903a4f95f104383e982
SHA1

458b3b5d0f5c8cf41094d9338d98c65f32f8f421
SHA256

b0c421799374660718f035236aebaf85b8457f9280b76f0d8699d6ea75aacbec
SHA512

6b5e3f216dc9f8fb831c6074bc016062d35917656301b604d0c89a6b79213e668f008d376cb75ab827cb3ddb35ffd51bbc2a36755d3b1bfbf8bf96daef20ff52
SSDEEP

3072:ALhsVL9tVlz+IdE1UkRgtOltEA8CchW7vtRrwLm7dDhqQIUyT04GE:A9K9tVlaIQXRgtOlCA8Cch+vtRMqTbPo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

freshclam.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	freshclam.exe

C:\Users\Admin\AppData\Local\Temp\engine\freshclam.exe
"C:\Users\Admin\AppData\Local\Temp\engine\freshclam.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads