f648320b72566f7ca1968e3fc8cec1c9e71393a302fca3a1a4a495ff9061ef1b

Analysis

max time kernel
99s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b16f45bde3b75f698063fddd42e52610N.exe
Size

115KB
MD5

b16f45bde3b75f698063fddd42e52610
SHA1

156b85558b26327641e7f26c1cb65bb5d7dac13a
SHA256

f648320b72566f7ca1968e3fc8cec1c9e71393a302fca3a1a4a495ff9061ef1b
SHA512

d954102c694341b756c71c680673f6bd3887396285c1408108dbe1738642050026fcd0baa6a45796c5ffe358c60bd10cb60e4c06940a698841612e4bf6a2e158
SSDEEP

1536:W7ZppApBULcfpHLcfpSo3fCTmXadjUSbcDemTPAZk+cLtdNlb9PfESDOayxaJw:6pWpBwchc66W2QZwKS7G

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b16f45bde3b75f698063fddd42e52610N.exe

C:\Users\Admin\AppData\Local\Temp\b16f45bde3b75f698063fddd42e52610N.exe
"C:\Users\Admin\AppData\Local\Temp\b16f45bde3b75f698063fddd42e52610N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...