e525a86c0fc0656b623904c8ceede564ff35b4bb36d399672d8614e0d74414cb

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dad1886dffa06d45c918690f06bd690N.exe
Size

111KB
MD5

4dad1886dffa06d45c918690f06bd690
SHA1

492254f6aac431ec4422ee7323d53edf7dd93e55
SHA256

e525a86c0fc0656b623904c8ceede564ff35b4bb36d399672d8614e0d74414cb
SHA512

99bd5b0e808db288c7f7fa7564e2dde7146e269df7ac17e1039eaf164f4cdbd7c4e2f4d095205ee99f1f7ffc383c7b7d1c0c5b72dc7a82da46db0627ac2a8bd9
SSDEEP

1536:W7ZppApBULcfpHLcfpJOtOcvOCg7WBaMrDOo:6pWpBwchcVmaAF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4dad1886dffa06d45c918690f06bd690N.exe

C:\Users\Admin\AppData\Local\Temp\4dad1886dffa06d45c918690f06bd690N.exe
"C:\Users\Admin\AppData\Local\Temp\4dad1886dffa06d45c918690f06bd690N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...