9ac091111a5734ca709325939065de5af7b7338c89b168e24ca29341156d033f

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb813ad3da7dcb8f51b1edda24957ad0N.exe
Size

571KB
MD5

cb813ad3da7dcb8f51b1edda24957ad0
SHA1

cacccda25a8cf6f92d4ec85ac6ac9671cd32e5da
SHA256

9ac091111a5734ca709325939065de5af7b7338c89b168e24ca29341156d033f
SHA512

f6a163778ebce8c301e48578d81de95f8ac67d9ceb0957829ad5fb8ca8f1e25059fd21a7d720379176df01cefdbd1499d619434f58248acca0980aa490ed82d4
SSDEEP

12288:qFtFDEe3OPgJ4wkHjBKCmQKXCUF6WDRwRvPT9N:qF7DEuiq2wCmQKf7DROP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb813ad3da7dcb8f51b1edda24957ad0N.exe

C:\Users\Admin\AppData\Local\Temp\cb813ad3da7dcb8f51b1edda24957ad0N.exe
"C:\Users\Admin\AppData\Local\Temp\cb813ad3da7dcb8f51b1edda24957ad0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2056-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download