4cdb0548b888ef58c1060e2086a56d288d694ff4c96d8378e42e63531c44c5d9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cdb0548b888ef58c1060e2086a56d288d694ff4c96d8378e42e63531c44c5d9.exe
Size

95KB
MD5

2c82d67e371bf00035aa68d5d4c1cd93
SHA1

80970a05975e461bb5593b0e42505832a7c16386
SHA256

4cdb0548b888ef58c1060e2086a56d288d694ff4c96d8378e42e63531c44c5d9
SHA512

d16f0a8e08732c4f7987e41770e0a121819a5dc3242521a1188cde9b3fc959ba01e1cfd99221f823a13eb9c5de8df89cf676ed07825fc5a10fcf189414461654
SSDEEP

1536:W7ZppApaJofJo8YvJtLJtGizHSXIBlE3hha08yZySzCeEKB2qNqJAIM5:6pWp0HSXIBlf08qySzCeES2qNq+5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cdb0548b888ef58c1060e2086a56d288d694ff4c96d8378e42e63531c44c5d9.exe

C:\Users\Admin\AppData\Local\Temp\4cdb0548b888ef58c1060e2086a56d288d694ff4c96d8378e42e63531c44c5d9.exe
"C:\Users\Admin\AppData\Local\Temp\4cdb0548b888ef58c1060e2086a56d288d694ff4c96d8378e42e63531c44c5d9.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...