940a7d4e1613857af693baebef5a089e3bc7a341a628798e2e39dca12a482eac

Analysis

max time kernel
101s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7ab31f7d787f6320992ed43f0040330N.exe
Size

144KB
MD5

c7ab31f7d787f6320992ed43f0040330
SHA1

703eea97509de09bdbeadd5862469c22a2bf05c1
SHA256

940a7d4e1613857af693baebef5a089e3bc7a341a628798e2e39dca12a482eac
SHA512

5a8b1e4336f554bef1f62d22f3944d779b94c5e5fa6a56efef8aaffdcfeccd52c322eb3236d379eb0f67d4ea97004d709bd5f905fa941eaef860a1c4b8768dd2
SSDEEP

3072:69WpxTcfWVP2ZQfq6Tl7j66sfmTk3WwK1A:n4WVWQVm6S3WFA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7ab31f7d787f6320992ed43f0040330N.exe

C:\Users\Admin\AppData\Local\Temp\c7ab31f7d787f6320992ed43f0040330N.exe
"C:\Users\Admin\AppData\Local\Temp\c7ab31f7d787f6320992ed43f0040330N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...