07f31e6d8a21d8386bcc49f7626dd813b42abe7a6c9c36391b0e0d2742aba62b

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07f31e6d8a21d8386bcc49f7626dd813b42abe7a6c9c36391b0e0d2742aba62b.exe
Size

162KB
MD5

658079f7ae7d77e5da0a26c59280ffa4
SHA1

e1d47c1a4b3e7817f8376038d86722784645238e
SHA256

07f31e6d8a21d8386bcc49f7626dd813b42abe7a6c9c36391b0e0d2742aba62b
SHA512

b79a6b5735243a2e26789c3b4965cedc0000ea4c1443d21fc3d44e21678b262dc4bd1fc8b2eeccc6545df9a71747328e19e60409b17c10025ca01bf41b481e59
SSDEEP

3072:p4d5Eow66zVJaolwYG0/xZJAV9DoRBbGyI3RmRuYdv/gw2D:edv6zKYO9URxjI3ERuYdvZI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07f31e6d8a21d8386bcc49f7626dd813b42abe7a6c9c36391b0e0d2742aba62b.exe

Suspicious use of SetWindowsHookAW 1 IoCs

pid	Process
2712	07f31e6d8a21d8386bcc49f7626dd813b42abe7a6c9c36391b0e0d2742aba62b.exe

C:\Users\Admin\AppData\Local\Temp\07f31e6d8a21d8386bcc49f7626dd813b42abe7a6c9c36391b0e0d2742aba62b.exe
"C:\Users\Admin\AppData\Local\Temp\07f31e6d8a21d8386bcc49f7626dd813b42abe7a6c9c36391b0e0d2742aba62b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookAW
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-0-0x0000000001000000-0x000000000102C000-memory.dmp

Filesize
176KB

Download
memory/2712-1-0x0000000001000000-0x000000000102C000-memory.dmp

Filesize
176KB

Download