cdfd7decb18b1049716957348e6d0026203ccf4d8118494a28f2f25b1d677514

Analysis

max time kernel
31s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50f8a4830add1ff7969127397fd285e0N.exe
Size

150KB
MD5

50f8a4830add1ff7969127397fd285e0
SHA1

b2956d07167ee5e0495c259e86b293db4c36d125
SHA256

cdfd7decb18b1049716957348e6d0026203ccf4d8118494a28f2f25b1d677514
SHA512

96bc3cf32dd3c04974a8c6b9cbcd42d33a57d394e3c4025300b5c376c935f3b697dcc6b005d567eaef4c305120287b74fbd74033bbbef6e524e208e2f47ebb13
SSDEEP

3072:6pWpBwchcwDo0uxOK+Z0+zK69kUfChRfomf6D:PTuxOK+TzD9kUqhO3D

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50f8a4830add1ff7969127397fd285e0N.exe

C:\Users\Admin\AppData\Local\Temp\50f8a4830add1ff7969127397fd285e0N.exe
"C:\Users\Admin\AppData\Local\Temp\50f8a4830add1ff7969127397fd285e0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...