08ba880bac0db6a3b543104aaaa945b8d7537d43feef58eb287aeb73fae90577

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

08ba880bac0db6a3b543104aaaa945b8d7537d43feef58eb287aeb73fae90577.exe
Size

2.0MB
MD5

2c24094be5c63654afc33493249bcc91
SHA1

4129f9f6594f0ccb7e31b7299cfcd76a66704b6d
SHA256

08ba880bac0db6a3b543104aaaa945b8d7537d43feef58eb287aeb73fae90577
SHA512

5df2777cbf67c3de7dfd3fa480e7059fb1548354a68bcdbdc11b8185bfd2439abaa2f713c5f770bcb505fb1e38e8cd0289175ac1a339f222a023197ee5b1896e
SSDEEP

49152:+VAbwXN2neoFmNWAAtFa1jZrtMnQCFvO9v2j:KA8cnz48PBnQcmvS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1724	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08ba880bac0db6a3b543104aaaa945b8d7537d43feef58eb287aeb73fae90577.exe

C:\Users\Admin\AppData\Local\Temp\08ba880bac0db6a3b543104aaaa945b8d7537d43feef58eb287aeb73fae90577.exe
"C:\Users\Admin\AppData\Local\Temp\08ba880bac0db6a3b543104aaaa945b8d7537d43feef58eb287aeb73fae90577.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1488
- C:\Users\Admin\AppData\Local\Temp\7zS0D58E1E6\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0D58E1E6\setup.exe
  2⤵
  - Executes dropped EXE
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS0D58E1E6\setup.exe

Filesize
5.1MB

MD5
20cdc00b9cf50abe0158a9dda8f9346f

SHA1
1fb747a49e0328bd0401778dc75c48c0393669d3

SHA256
07b79f7f5089a14eb59ff3cf01dc7f9174ff03ebf4b5b1498a70dc31835220d9

SHA512
e5e7ea28721559c765fc412fac9de0a54ff0202b03880f469f0e862e6503987b2c49b313905d3d68eec0b11613e0a074cd55bab0e62e0b7cc4f20e7ceca20078

Download Submit