2488ac68da6e92e61b43fc7842e9df99112a0e9fcda3e6429dd931ca0b3be1d1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6b8eed3866c2afdf862bf3fe0894e130N.exe
Size

63KB
MD5

6b8eed3866c2afdf862bf3fe0894e130
SHA1

b86720b6833ffee73d2e10a78f81a9d7aa86bbbc
SHA256

2488ac68da6e92e61b43fc7842e9df99112a0e9fcda3e6429dd931ca0b3be1d1
SHA512

563050c1f25a99a35058524d8d681de9db2352aea14aa002203b8749e7dcc5af4407de3d14e61da79b0d55f5a60e5f003c333399673606cd56bc7e29ca0ab9f0
SSDEEP

768:buktR6HcSfQLEZ9eTzMccLazSve/KanBzuegqHMs+:bukXcVU/GXKtBUAM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6b8eed3866c2afdf862bf3fe0894e130N.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	6b8eed3866c2afdf862bf3fe0894e130N.exe

C:\Users\Admin\AppData\Local\Temp\6b8eed3866c2afdf862bf3fe0894e130N.exe
"C:\Users\Admin\AppData\Local\Temp\6b8eed3866c2afdf862bf3fe0894e130N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-0-0x0000000001000000-0x0000000001013000-memory.dmp

Filesize
76KB

Download
memory/2740-1-0x0000000001000000-0x0000000001013000-memory.dmp

Filesize
76KB

Download