1c6d948058560336bc694b96008f3c6e2272fd507ab2f2d2dc8ce12bb2e530fd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cmcark_gui.exe
Size

2.4MB
MD5

f0495c5c01c8acff447561b53bc0abb2
SHA1

f50855b01bb64959357afe1f6cb77a567e118fe3
SHA256

0b6a46cd5589eaaade67b52607520599a831f7e8fdd74623857bb7a1b6219b69
SHA512

c5788878ff9601ef260d4ff512c9533f5f2367740ca18fa03d2209dd8dd6ee05be9633e9183e748b3346b85088a74e7dbc9b8da5d5c666175c01d53643c804de
SSDEEP

24576:YCXZxF4GJnGkMzHZQ6ZtZInRmHAL+oSm8H2M+Aba1ntCz2e2ONzT3+vz1UP/z7oT:hZx5a0VCPzH2VAcn3uX+vKP/z7oZGWp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmcark_gui.exe

C:\Users\Admin\AppData\Local\Temp\cmcark_gui.exe
"C:\Users\Admin\AppData\Local\Temp\cmcark_gui.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2944-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2944-1-0x0000000000400000-0x000000000066F000-memory.dmp

Filesize
2.4MB

Download