4970c10580915d48f5d5e2a587c9c155c0e9d9a8f91947927edb4ad0e1a981bd

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4970c10580915d48f5d5e2a587c9c155c0e9d9a8f91947927edb4ad0e1a981bd.exe
Size

903KB
MD5

81c48ba026a76680b0f3c039fe7a0811
SHA1

b1175845f16178993d2c23bf10d7a8c83507050a
SHA256

4970c10580915d48f5d5e2a587c9c155c0e9d9a8f91947927edb4ad0e1a981bd
SHA512

13b80cd5d1517e225d36e1e718de425c75a1ac516865c902c34c7e2ce9b44bb4d5051b339cfc8ec0218757c8ff7a8230799c12456967e30bb548bafd287e720a
SSDEEP

12288:ZJhTM2dl9xuZluXGfgD/ckObYf2RCry/3zN2iaGnVngD3A2Ow0SrEoBF9noTTInc:lu/jc09kSp2R1OwFrF9ooXcv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4970c10580915d48f5d5e2a587c9c155c0e9d9a8f91947927edb4ad0e1a981bd.exe

C:\Users\Admin\AppData\Local\Temp\4970c10580915d48f5d5e2a587c9c155c0e9d9a8f91947927edb4ad0e1a981bd.exe
"C:\Users\Admin\AppData\Local\Temp\4970c10580915d48f5d5e2a587c9c155c0e9d9a8f91947927edb4ad0e1a981bd.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x0000000000400000-0x000000000313E000-memory.dmp

Filesize
45.2MB

Download
memory/2224-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2224-2-0x0000000000400000-0x000000000313E000-memory.dmp

Filesize
45.2MB

Download