41d741452fac682a03593f59409b5ebf15c6c216c240751f42ee154f541440cd

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49feb0ff0efe71e9f9d16c35f98cea40N.exe
Size

175KB
MD5

49feb0ff0efe71e9f9d16c35f98cea40
SHA1

f7c02df2f58f72805b92d1f767ff023775068a32
SHA256

41d741452fac682a03593f59409b5ebf15c6c216c240751f42ee154f541440cd
SHA512

b3ad8f7f419b622258ca873fc4f041d5f3e30317e53e1727f9e85e3fd0cd42e2070be7544e0e8853bf0d77b872899b947aee95f3ba79dd2296ead77fd80bb0b7
SSDEEP

3072:6DWpwE7oL2e+efZwZ08i8z3MLO6W2QZwKS7L:dN/e+efimJa3MLi2ZKS7L

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49feb0ff0efe71e9f9d16c35f98cea40N.exe

C:\Users\Admin\AppData\Local\Temp\49feb0ff0efe71e9f9d16c35f98cea40N.exe
"C:\Users\Admin\AppData\Local\Temp\49feb0ff0efe71e9f9d16c35f98cea40N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...