7f91700009f6beeb3664b19562e1927eacbb64b7b07a64ad730b6c2e4aa44883

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ad43be92713fdb1effe650655d82950N.exe
Size

127KB
MD5

3ad43be92713fdb1effe650655d82950
SHA1

d60f06f6c9eb48936541a2ccf85231f40b462d2c
SHA256

7f91700009f6beeb3664b19562e1927eacbb64b7b07a64ad730b6c2e4aa44883
SHA512

604bfd2444443829c3b13f089771b4265a0b621ba20ae72981962a5603023f8f1e5a0c81e7284ab254839e9c457240937b542539681c7f61dbad2f8d258753cd
SSDEEP

3072:9QWpIng9iMGfUSaOy9SnJUwFU+FUhFUeFUXFUqyqKRrpF6Pwa:LSng9iMGsSaOyi1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ad43be92713fdb1effe650655d82950N.exe

C:\Users\Admin\AppData\Local\Temp\3ad43be92713fdb1effe650655d82950N.exe
"C:\Users\Admin\AppData\Local\Temp\3ad43be92713fdb1effe650655d82950N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2960-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download