a1f3a6be9d1268113c1efb542a5e1fe1346073e56abdaf9a756ce0cff3f182d3

Analysis

max time kernel
10s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1f3a6be9d1268113c1efb542a5e1fe1346073e56abdaf9a756ce0cff3f182d3.exe
Size

174KB
MD5

27c6c21fb5d7661a6b3af533dade1e35
SHA1

7adcbe7791f29d51b81fead5040c918cecf202d1
SHA256

a1f3a6be9d1268113c1efb542a5e1fe1346073e56abdaf9a756ce0cff3f182d3
SHA512

38d1d9e207ac4e45f1b19c52492936e9c20d29d3da36f8e91dabce3462e73e73f3dcc6be581b74aaa9a577ac36c0b2efacf7a59a4bafb04701aafa0630e7cada
SSDEEP

3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9ileqUgK6W2QZwKS7L:RqlIyFESWu0SWu86jYleqQ2ZKS7L

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1f3a6be9d1268113c1efb542a5e1fe1346073e56abdaf9a756ce0cff3f182d3.exe

C:\Users\Admin\AppData\Local\Temp\a1f3a6be9d1268113c1efb542a5e1fe1346073e56abdaf9a756ce0cff3f182d3.exe
"C:\Users\Admin\AppData\Local\Temp\a1f3a6be9d1268113c1efb542a5e1fe1346073e56abdaf9a756ce0cff3f182d3.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...