faa87251336d864b877a5e6c3e9c9a5e250318be2fdfc8a42ceadb3a956e0405

Analysis

max time kernel
2589s
max time network
2285s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7z2408.exe
Size

1.3MB
MD5

d646419d462f0206a3341aef0aa5e3c7
SHA1

eb4b809bbf91804e9bb17be36e9469818601ed91
SHA256

faa87251336d864b877a5e6c3e9c9a5e250318be2fdfc8a42ceadb3a956e0405
SHA512

7f6c46c780fcb5fc10cc5405221179ddecbbb871c578ca3d9e3a74141271b383bd83e8f9d75c98d7e9d406e9b935d52a6b04913d654169e0b30f0719225e7dd9
SSDEEP

24576:0AkPEo1y9fcw5K42KmEDCesqTvbdWZWz08ZuEzamDoyhbxGC7eBRak0a7IU9F0:0AJoo24xVWerHkZWAbFWoyhiakn7IU9S

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	7z2408.exe

C:\Users\Admin\AppData\Local\Temp\7z2408.exe
"C:\Users\Admin\AppData\Local\Temp\7z2408.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads