0ed4e0f2262d01a3cd441fc0e5cd5fe9c8088becea80b24c78214eb308e7a0f7

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a1ebbbb1a2ae8fbbfac152d47bf12c40N.exe
Size

129KB
MD5

a1ebbbb1a2ae8fbbfac152d47bf12c40
SHA1

51d0d6b9b76a953e0ad0a3b6db6386687b9fd356
SHA256

0ed4e0f2262d01a3cd441fc0e5cd5fe9c8088becea80b24c78214eb308e7a0f7
SHA512

43fda5bf1e13a1c31befff4a30c0fedd8a668b4f85d03b7c303408645729faab1d09ba709d0b99cb21a36a6fca7b449cff0c82f77c077d3dfb7af30aa201cfad
SSDEEP

3072:JLV6q9R/dlMMMMM2MMMMM8Sp46B65j+B2QAdNXwI+5GbbmHtR:JL8CRVlMMMMM2MMMMM6G61+cLXwr2bmz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1ebbbb1a2ae8fbbfac152d47bf12c40N.exe

C:\Users\Admin\AppData\Local\Temp\a1ebbbb1a2ae8fbbfac152d47bf12c40N.exe
"C:\Users\Admin\AppData\Local\Temp\a1ebbbb1a2ae8fbbfac152d47bf12c40N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-0-0x0000000001000000-0x0000000001023000-memory.dmp

Filesize
140KB

Download
memory/2584-1-0x0000000001000000-0x0000000001023000-memory.dmp

Filesize
140KB

Download