341dfa8cc975233055495070cb6ef14918f458710cc5826e789567ba3ec0f497

Analysis

max time kernel
144s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Amazon dvd shrinker.exe
Size

440KB
MD5

af223be38d1c140242d0388fd24d939a
SHA1

e1db99cce487e0d73778322cafea13eae9ca0638
SHA256

c5f91cbf4aa078497110c705c7d4a710f61f57df8407793ed81c87d1cdf94df8
SHA512

e28a9809068bc7badd9dfb64d3090b6deabbc324d8f84b7ed5ef21b11d5f29dd334df8d2c1e304600f7b5ce55dfced174668244e1c1ab963a891ebf1a4f5072f
SSDEEP

12288:WBUzSxBAEP6uK26sgiSrzKi6UvQPHsoD1eJ:W+WWmfWseKij3okJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amazon dvd shrinker.exe

C:\Users\Admin\AppData\Local\Temp\Amazon dvd shrinker.exe
"C:\Users\Admin\AppData\Local\Temp\Amazon dvd shrinker.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3232-0-0x0000000000400000-0x0000000000591000-memory.dmp

Filesize
1.6MB

Download
memory/3232-1-0x0000000000400000-0x0000000000591000-memory.dmp

Filesize
1.6MB

Download