eaa91f4cd6cbb5425126191a73103dbc63798b6b7f3b74b6e41e5a8d818cc8df

Analysis

max time kernel
141s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6677.exe
Size

2.4MB
MD5

32679e2fd3480c5dbc6489e1e9493abb
SHA1

236feceda4c9ebbff712e8d1712d499b23995218
SHA256

aad448f4a9c6adcb9b17dcfd48eefac8ebcc51388d745b48c9a8c99f31261ea5
SHA512

85196fdd04bbfa08e245d5c167ffe9eab7e5b794c9393beb97b94708a0a3ff2df537ba6dbfe0651dd59e323d3afecf233346d92d10261029cdbd0c759e580192
SSDEEP

24576:Welo5jh+9b8SL1lAdL5+FPI3YqOcHQSFablTmVfBxquGjHneFUJfKjS2CGm4j9R2:vl+h+1qs0Y/BTmguGjHnevjS+E

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6677.exe

C:\Users\Admin\AppData\Local\Temp\6677.exe
"C:\Users\Admin\AppData\Local\Temp\6677.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-0-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/4796-1-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/4796-3-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download