ab685cf56c41f3c5f0bd64a49824c5135fbdf3550868f297c722d37213c0b7a9

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab685cf56c41f3c5f0bd64a49824c5135fbdf3550868f297c722d37213c0b7a9.exe
Size

48KB
MD5

e14e0c99ee9728ff9c29b90188bb5380
SHA1

d37e03a230406f2716a4ef66e041623211124a60
SHA256

ab685cf56c41f3c5f0bd64a49824c5135fbdf3550868f297c722d37213c0b7a9
SHA512

2166c6f3520c3d11509d06d08333c5f16a49bfbf1a9872bace22fec8caf9ba2260d8b23b72b7ad555e2a4d401e19b14c5ff5a40b6422408a8f735ed578561475
SSDEEP

768:9GvbqsQdX5BhGEnOsIzfJ4i4g5p0syi+hvN18K3H8T6++3Kd8VVrG2:4zqsQ5PIt4+/yfeB6rXVrG2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab685cf56c41f3c5f0bd64a49824c5135fbdf3550868f297c722d37213c0b7a9.exe

C:\Users\Admin\AppData\Local\Temp\ab685cf56c41f3c5f0bd64a49824c5135fbdf3550868f297c722d37213c0b7a9.exe
"C:\Users\Admin\AppData\Local\Temp\ab685cf56c41f3c5f0bd64a49824c5135fbdf3550868f297c722d37213c0b7a9.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\My Downloads\International Cricket Captain 2003 ISO - Full Downloader.exe

Filesize
48KB

MD5
198452b61cd44892e6f668fd408f2a38

SHA1
0fe6dd241070563f5bcbebfd4d30c9d382964dc2

SHA256
f573962ee30b022f66d3f3a1a20ffafdebf0427b1c65a2545ded5232298df576

SHA512
60f163f482ae9ef2b90ef5c2f224f1c8dd1d499af1522e794bbf7fc25210fa0320e91dec80ca821f3c91b2c99fdfad4155228ebaa452ea695a5396aca490707c

Download Submit
memory/1288-100-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download