4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f

Analysis

max time kernel
38s
max time network
43s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06/09/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpySheriff.exe
Size

48KB
MD5

ab3e43a60f47a98962d50f2da0507df7
SHA1

4177228a54c15ac42855e87854d4cd9a1722fe39
SHA256

4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f
SHA512

9e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f
SSDEEP

768:18Gch4aqHnKckG0HrloMOInk3RicH0wDrF5X9gFEvkk3p:1hN/k/ZomkhewDR5NVvkk3p

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpySheriff.exe

C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe
"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4776-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4776-1-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download