baaaf97d8fca6ba2383973f710224d0448737797019a3ce0c39203bd9e4cc7d6

Analysis

max time kernel
130s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baaaf97d8fca6ba2383973f710224d0448737797019a3ce0c39203bd9e4cc7d6.exe
Size

138KB
MD5

328972a1301c1158fd2b233d4b145d2f
SHA1

002bf825d669f1165ade7dc0fa3c44d93ff5bd93
SHA256

baaaf97d8fca6ba2383973f710224d0448737797019a3ce0c39203bd9e4cc7d6
SHA512

56dfc811fa2d572bd6e60cc2c9103688ab7cd1f1c63224e685bcaf08b2b85da59ccfc110fe26dc1e5780fbac0c9be1d1fce094ed02caa06d7e23692f98ba0a2e
SSDEEP

1536:W7ZppApqvZvITwOP+UDpOP+UDQOtOcvOCg7WBaMrDOk:6pWpHXYXCmaA5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	baaaf97d8fca6ba2383973f710224d0448737797019a3ce0c39203bd9e4cc7d6.exe

C:\Users\Admin\AppData\Local\Temp\baaaf97d8fca6ba2383973f710224d0448737797019a3ce0c39203bd9e4cc7d6.exe
"C:\Users\Admin\AppData\Local\Temp\baaaf97d8fca6ba2383973f710224d0448737797019a3ce0c39203bd9e4cc7d6.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...