0586cd1a3f1006d8a58e43326be70524a0250c0ea3c60da0afb14f8d2cb3ec15

Analysis

max time kernel
6s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

unins000.exe
Size

1.4MB
MD5

13c7e3177ffffd9e7e89d3c59a022e5f
SHA1

4cf6ad20fd71e6aa7c62e717b6257b1e6da48632
SHA256

0586cd1a3f1006d8a58e43326be70524a0250c0ea3c60da0afb14f8d2cb3ec15
SHA512

5838876b7b1e955b9aae570486a16d0fdbd61b935b3b4f8fb2a0b137a1efc6c02fa617315ecbaeedce6f4c507d29fba6208d2529c466a3874ae57b0691c4e98a
SSDEEP

24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextx7:cIEJxCWluyZ8UbMKf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe

C:\Users\Admin\AppData\Local\Temp\unins000.exe
"C:\Users\Admin\AppData\Local\Temp\unins000.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4196-0-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4196-1-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download