7488c30d27494bab671e3adb61eedffba736eb0cbafcccc7c6275bb8eefaba71

Analysis

max time kernel
110s
max time network
91s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

674cc26d0636815aee9b98603d56b670N.exe
Size

139KB
MD5

674cc26d0636815aee9b98603d56b670
SHA1

ee869464ede56331bce6f73552387f23a5f40430
SHA256

7488c30d27494bab671e3adb61eedffba736eb0cbafcccc7c6275bb8eefaba71
SHA512

679f1948c797383a61ddef39659a536eedee4817a47217af07cb6201cc51e4c9d44e1e366f98a48bffbd6b1be222a72c1485ce5bcf86b31774aa34b9362a3ce9
SSDEEP

3072:hs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/w/Fnncr5:hDeM7iNEkgiOb31k1ECOJq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	674cc26d0636815aee9b98603d56b670N.exe

C:\Users\Admin\AppData\Local\Temp\674cc26d0636815aee9b98603d56b670N.exe
"C:\Users\Admin\AppData\Local\Temp\674cc26d0636815aee9b98603d56b670N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-GB7HtzD8RE7k1vyl.exe

Filesize
139KB

MD5
dd77b17f3b594178cc14dd917804d2b8

SHA1
16d8b3a6e1c8090f7d51a5bd8bb9034bbbe82d71

SHA256
e81966e3b56597d3b941f4940504052284bfe7d239882577780c76c3a67b0389

SHA512
3314fe16b8596b01e5853b22256a26db87ff366468479ebd355536d73b240c1c4d0bc1e1ee7a0d2b24fdc70f2d6a34ec598c321356152892781a97dd6d4f0890

Download Submit
memory/2688-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2688-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2688-13-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2688-21-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download