d2d3ae24613b4362b7f52aff16feb6c4dc4ad2b3cea7cea348aa1c4e8937904a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PSmplay.exe
Size

444KB
MD5

a030ba97110de8b607204cc72cd696f6
SHA1

dfdc43424f8a145f1a78c7760b0a18383c2e10ed
SHA256

f47bfce8e162de447ece451db1b9847e4c0fae1219a97a0742f45ebf461cf550
SHA512

6507f7efb7986aa96214c6d0c909f3ed830149ba32ffd9a81c57aa47c621df0d52ffa8887e82069f84d485087ef9844e24b9427db1c2411bebdf99c89648862b
SSDEEP

6144:zimI7seUA3TzhcWIDUVBbrryACi3F9jQ86VbTeaN/o56HOpVlSjlhzBZ9+UK:zi573zhNBOs9EbTe6HOOlhNZDK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSmplay.exe

C:\Users\Admin\AppData\Local\Temp\PSmplay.exe
"C:\Users\Admin\AppData\Local\Temp\PSmplay.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...