3c7ecbb7135408c2e95a53662ae87c5347b53e1902add82dc92c648a78059cf2

Analysis

max time kernel
115s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f4bef340666209d140084323b3af200N.exe
Size

47KB
MD5

9f4bef340666209d140084323b3af200
SHA1

70291962917b518221bc837678acab3b21f20cb1
SHA256

3c7ecbb7135408c2e95a53662ae87c5347b53e1902add82dc92c648a78059cf2
SHA512

31bfe9ffccc52a386d907d0783e0525be6adc71f7b96b20ea109505b0625af2b903534d2aa36838b33612e7881617ded70cb218cb2a9a607ab572ca5dbd6b52a
SSDEEP

768:9GvbqsQdX5BhGEnOsIzfJ4i4g5p0syi+hvN18K3H8T6++3Kd8VVrP:4zqsQ5PIt4+/yfeB6rXVrP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f4bef340666209d140084323b3af200N.exe

C:\Users\Admin\AppData\Local\Temp\9f4bef340666209d140084323b3af200N.exe
"C:\Users\Admin\AppData\Local\Temp\9f4bef340666209d140084323b3af200N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\My Downloads\Warcraft 3 ISO - Full Downloader.exe

Filesize
47KB

MD5
945d81a37f5175975cbbefa63161d59a

SHA1
783951613958487426af760d7fd4487bef68be20

SHA256
97bae9609ab5294d105ba45d7697895a6562c9b68d909382d0d5fe47f584a8fd

SHA512
52c232e61354286b02ecdd1a4a5dfe8596a932993c0eed669a17f6b6828fc1a82820c766e71989f8edffdb27d6f2e6ae8410bb334ff584c4f81f903ec86a6afc

Download Submit
memory/3800-100-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download