0b182848cc93a7b90e26a0d1846a1d4639f0116ea13bbe90c5c7b239895fb18f

Analysis

max time kernel
82s
max time network
83s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06/09/2024, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Keygen.exe
Size

5KB
MD5

ce7aff41b893a07cb610151d4f732002
SHA1

d5655dcc3b292b12980fabe71bf9653b68ce17c4
SHA256

0b182848cc93a7b90e26a0d1846a1d4639f0116ea13bbe90c5c7b239895fb18f
SHA512

c07009e1f9bae9cbc8a4309ca49eb171b0f2633459c1eb59734927cbeadd4af49fae639051cdf5f55c9813bd12c139c55a2c6e890f2b1fd97173914d3b320943
SSDEEP

48:68Dcn5z+lGiXNevej5LRApI8V6FX96tRBDWXU/bin7+7BW:tAn5z+l5NGej4D6FX967Mk/eC7B

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4588	Keygen.exe

C:\Users\Admin\AppData\Local\Temp\Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads