ba06433033d955289c16e22468ce3ab721e7bbadb5a1562259df84ab1051d0e0

Analysis

max time kernel
138s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

j-dvd-to-divx-converter.exe
Size

5.7MB
MD5

e84972291a1c5900506418645d9bb260
SHA1

846762c46a540ab8a4069d18c644a9a791adbc89
SHA256

3e18612c373288b8c7c1ab1c21bfeea54239821eca3fdb385676eb4a7ff21bf8
SHA512

b6e91b6507e678cab4c27007c713e96fe8dd56079ec8c7622b617476f1db82b4c5329136d0d4c160b31c4fc5e924df16110db7a45a905668e38f1070634eb4ea
SSDEEP

98304:SRdmHSTpOZrwv7cyV1qvpOzKiPbVGFQiLlxs6/jGkloETfZcP1uGh6TrZNOF4Q:SDvQZrwoGpWVDs0p61uGhyZNOF

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
964	j-dvd-to-divx-converter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j-dvd-to-divx-converter.exe

C:\Users\Admin\AppData\Local\Temp\j-dvd-to-divx-converter.exe
"C:\Users\Admin\AppData\Local\Temp\j-dvd-to-divx-converter.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl6227.tmp\LangDLL.dll

Filesize
4KB

MD5
9bbf0b6948ae83d0d322b6ab56e2ee9b

SHA1
b4c97bb3f403ec5f2c3773f21b452983a275d110

SHA256
8872c5b2372180371d535ca2a3e4c2a4b25791c6780e0d3836efa7568ede3109

SHA512
33f474257dddcd21835136422b59eecabb13fd77defdeae1520c4407a745948becfb45fc4dbecd1f674c120086fc5127106b5bbb211bb3a980c1c6a82fd3d638

Download Submit