31244fde2afe51e3e3813d154afa7ef611e7c34ff1932ab814ab5d8f4b392836

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31244fde2afe51e3e3813d154afa7ef611e7c34ff1932ab814ab5d8f4b392836.exe
Size

18KB
MD5

8d6f394288316996742480b2b7534be9
SHA1

2dad353779392ba0d86671719092dae5ff023062
SHA256

31244fde2afe51e3e3813d154afa7ef611e7c34ff1932ab814ab5d8f4b392836
SHA512

fa46edd417162e0a20ef8eebbc2eeb159a5cb91631f535aa9627c9ee083b0a27400f9e9ddd765af5ed9d3db63d75adb1bb7be4c65e87baa49a0aaf278ffcdfa2
SSDEEP

384:ICEo3MQ1kZIu+omYpiGF+gLFKQAQvIERIX:ICEjQyZIFopbKQAQvIH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31244fde2afe51e3e3813d154afa7ef611e7c34ff1932ab814ab5d8f4b392836.exe

C:\Users\Admin\AppData\Local\Temp\31244fde2afe51e3e3813d154afa7ef611e7c34ff1932ab814ab5d8f4b392836.exe
"C:\Users\Admin\AppData\Local\Temp\31244fde2afe51e3e3813d154afa7ef611e7c34ff1932ab814ab5d8f4b392836.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/228-0-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download