246b9cd12a9223e2391eba6bceea79015b598b701a22294bd4373355a3b47c2e

Analysis

max time kernel
132s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinTools.net Ultimate/Language.exe
Size

177KB
MD5

700607f40de3d06726994ee3629a1f82
SHA1

3ce7d64f1bce8faa9cc2f269fb7ceb3a68c470df
SHA256

ecfbffa2ccc5fb2b94d8548b2b695207c8c63106d05c1c52b5c1e39969ff9e67
SHA512

749f649d7e7bf2aaa6280e3e5451df88aa6068175b79c6940a37ff372268d6f725cd905b441f87acdd841b9474d3985d42b0e1018da2f77363db607dcba91afd
SSDEEP

3072:zKL6fPGgoLu5gwepyLUOMsL7Ynfj2eXYSmlqg/7TbOSPPOjLOoKpl0:mL6HGgUtQT9kfjhulqATRng0U

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Language.exe

C:\Users\Admin\AppData\Local\Temp\WinTools.net Ultimate\Language.exe
"C:\Users\Admin\AppData\Local\Temp\WinTools.net Ultimate\Language.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...