08fcd95a57a230d0cf6c9402fb4a0f91c9f7540c911d4b684744c1ac70af665f

Analysis

max time kernel
31s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-09-2024 00:12

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

a4d95eae320e9c813d0f80ed6e3a7c40N.exe
Size

257KB
MD5

a4d95eae320e9c813d0f80ed6e3a7c40
SHA1

2aef3875cb9b863668580276f7c3ad019dc43f5b
SHA256

08fcd95a57a230d0cf6c9402fb4a0f91c9f7540c911d4b684744c1ac70af665f
SHA512

6f38f7252d9a96bd990e5b20f88a7c595b2f6b1eb57ebc9aeba87b427eec4f8e2567a4480facf159427696cc3be03bba0a00818ebbca0d51ca5e04b311178ce1
SSDEEP

3072:bhWunyJGLyH9qKOzCaVUikfu8JyH5g58HWMoeqUm8ZqTQD/Gn7e5mLjH1:bhhDydqKTaVUikJJb4Q8Zqh1LjH1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4d95eae320e9c813d0f80ed6e3a7c40N.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\a4d95eae320e9c813d0f80ed6e3a7c40N.exe = "7000"	a4d95eae320e9c813d0f80ed6e3a7c40N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\a4d95eae320e9c813d0f80ed6e3a7c40N.exe = "7000"	a4d95eae320e9c813d0f80ed6e3a7c40N.exe

C:\Users\Admin\AppData\Local\Temp\a4d95eae320e9c813d0f80ed6e3a7c40N.exe
"C:\Users\Admin\AppData\Local\Temp\a4d95eae320e9c813d0f80ed6e3a7c40N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads