31e347b556164f5e2d068ed6be0101b8ee12a248be2ced71a6744db817d787b0

Resubmissions

03/09/2024, 21:32

240903-1dvy9syeqh 3

03/09/2024, 21:15

240903-z35pbsxcnm 3

03/09/2024, 21:00

240903-ztqttaxalq 3

03/09/2024, 20:53

240903-zps4dawhll 3

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cisco AnyConnect Secure Mobility Client/manifesttool.exe
Size

339KB
MD5

c91a28843e645dbafbdfaca8f0ec77a9
SHA1

915f6c343777465c720d0b0ce6482de79d4e35c6
SHA256

d987bc0b335a9dafafcceaab8a10096994cd523f0fb69ac2913a048075b26072
SHA512

32f5f00db051191d6364dd34c1594280094f030b3d3aec89ecc87fb3a98a563a6514a2ec4b444fdd705eb9f29b94b7112bd8cf57de283ae4a6b111aca5171c48
SSDEEP

6144:CVDDK/8HsuSpfcUA2B+fsNMBYShENdkh4AOU7AtrXJp:CdK/8HsuSpEUA2aTYIEIyK7KXJp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	manifesttool.exe

C:\Users\Admin\AppData\Local\Temp\Cisco AnyConnect Secure Mobility Client\manifesttool.exe
"C:\Users\Admin\AppData\Local\Temp\Cisco AnyConnect Secure Mobility Client\manifesttool.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads