a6f3ff948d667a71d97a65ff9722bc01705c1c236fe6b1d90693d4aa45b4e199

Analysis

max time kernel
100s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e8d86fe2ff0bd8314f1e3fea6506480N.exe
Size

111KB
MD5

4e8d86fe2ff0bd8314f1e3fea6506480
SHA1

e5854bb2203f5383b512a3a0adc472d27795654d
SHA256

a6f3ff948d667a71d97a65ff9722bc01705c1c236fe6b1d90693d4aa45b4e199
SHA512

9ca52ad33e1ff24062993eb9adba2904f8eaa1269cc2b1a63ec3cceb8aa6f7390011925dc3be98a2ec86654d3c87ade22fa9a2f064defcf58cfa5047b31a2c58
SSDEEP

1536:W7Z9pAp9TmXadjUSbcDemTPAZk+cLtdNlb9PfESDOayxaJ7:69Wp96W2QZwKS71

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e8d86fe2ff0bd8314f1e3fea6506480N.exe

C:\Users\Admin\AppData\Local\Temp\4e8d86fe2ff0bd8314f1e3fea6506480N.exe
"C:\Users\Admin\AppData\Local\Temp\4e8d86fe2ff0bd8314f1e3fea6506480N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...