3c7ecbb7135408c2e95a53662ae87c5347b53e1902add82dc92c648a78059cf2

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f4bef340666209d140084323b3af200N.exe
Size

47KB
MD5

9f4bef340666209d140084323b3af200
SHA1

70291962917b518221bc837678acab3b21f20cb1
SHA256

3c7ecbb7135408c2e95a53662ae87c5347b53e1902add82dc92c648a78059cf2
SHA512

31bfe9ffccc52a386d907d0783e0525be6adc71f7b96b20ea109505b0625af2b903534d2aa36838b33612e7881617ded70cb218cb2a9a607ab572ca5dbd6b52a
SSDEEP

768:9GvbqsQdX5BhGEnOsIzfJ4i4g5p0syi+hvN18K3H8T6++3Kd8VVrP:4zqsQ5PIt4+/yfeB6rXVrP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f4bef340666209d140084323b3af200N.exe

C:\Users\Admin\AppData\Local\Temp\9f4bef340666209d140084323b3af200N.exe
"C:\Users\Admin\AppData\Local\Temp\9f4bef340666209d140084323b3af200N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\My Downloads\LordOfTheRingsr Key Generator.exe

Filesize
47KB

MD5
f4605f3b2ca03a45ddeb842c47efd5d6

SHA1
776ff7369180ebeb49da66199116df411bfba458

SHA256
6f2770d95afcaeaf180d44b80056a558a09610a52b99299181a8c72a315b6dd6

SHA512
1cbae014b84e8472695192198897a836eb50586abe34f886c52ae797e63a9277cfd5bbd1e7d57f26ca44e6e72dceee4e99edaf9a1a3dc45b753cb0346896105e

Download Submit
memory/2052-100-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download