ae2001d5b60a2f0bd8e72c0106363950cd9f68e9ce42b9a40b0af26814908809

Analysis

max time kernel
1s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21-08-2024 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/un.exe
Size

7.4MB
MD5

839640ba4c87b4a0fbd4d81fc54f8f51
SHA1

0fdf3cf3685de715f8206400a232bf389ce319d6
SHA256

58b8642b2665efde3974c18c2613b6e27dcf31fbb4b048339f93b2019c26d6df
SHA512

14b97fd80c8b58422949b9d8db2660e93c6ee7c41873e8388cc9b62396e791f346346465527088a50a58d6d9a358e21a8652a0934149dd6ed3947841a7e59354
SSDEEP

196608:SypQHMyhZz21iDr7Q8WjqvQ80j1FA9Epvk5MABT/4l8mBx88w:SypH+gADr70Wv6DA9G85nrc5lw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

un.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

un.exe

description pid process

Token: SeDebugPrivilege 2348 un.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un.exe

description	pid	process
Token: SeDebugPrivilege	2348	un.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\un.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\un.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2348

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-0-0x000000007429E000-0x000000007429F000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x00000000006E0000-0x0000000000E54000-memory.dmp

Filesize
7.5MB

Download
memory/2348-2-0x0000000074290000-0x0000000074A41000-memory.dmp

Filesize
7.7MB

Download
memory/2348-4-0x0000000074290000-0x0000000074A41000-memory.dmp

Filesize
7.7MB

Download