2147322197323cd5aea9bdfe92ca6da4e071dc196880a7bf531d2e53a12515dc

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plugins/Plugins_niu/UninstallW.exe
Size

212KB
MD5

593adf2a228ab09c4c5bedf195dd88f8
SHA1

4338defb86871ce90959f7b4694857cc3746d625
SHA256

38c2523683b6bfbf63bd7b4cab0235e72b5b3f28c8da854404087b6ba553a64d
SHA512

6c1f79b786970efe9cc223935b24a69e30daf1a8ddde6ec81bd1f240ab5b0615743549ede478ae9ac931123d3b866da5b4bbf0c8ca2dcd1b1b4ad37d253b0e07
SSDEEP

6144:Xs6uTJP+pw7P1D3X3/1lg/Fgw5MV5DD0M0UV8ei:XaTJP6w7NTXv6Flp3e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UninstallW.exe

C:\Users\Admin\AppData\Local\Temp\Plugins\Plugins_niu\UninstallW.exe
"C:\Users\Admin\AppData\Local\Temp\Plugins\Plugins_niu\UninstallW.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download