e9860d392342de0f90a6f55ec80e08c8a7a5ba8152154c18f8733a6e507d0276

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54d0e250d644d2b389d9a71f8cc5bf40N.exe
Size

110KB
MD5

54d0e250d644d2b389d9a71f8cc5bf40
SHA1

036d514cbfa2f15612bd40dcc1bef55e2e681d8f
SHA256

e9860d392342de0f90a6f55ec80e08c8a7a5ba8152154c18f8733a6e507d0276
SHA512

77f8750511026c21b4c10c1afcc3dd1ed66a9633efc479f2b6ecf1a18c9a02bba479c643d7b53f82288e35067cefb252b1d4079caf24b89cee28f92ea71ed29c
SSDEEP

1536:W7ZhA7pApXTdsdYSLjLoQwPEfa9rba1RYj7FKci4:6e7WpXBSLjvf8/YmwcP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54d0e250d644d2b389d9a71f8cc5bf40N.exe

C:\Users\Admin\AppData\Local\Temp\54d0e250d644d2b389d9a71f8cc5bf40N.exe
"C:\Users\Admin\AppData\Local\Temp\54d0e250d644d2b389d9a71f8cc5bf40N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...