fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 21:05

Target

Elevator.exe
Size

97KB
MD5

59803a5bb88b88a6d83342eeb3816ad9
SHA1

cafa43cacd584deb0d54ac31ae9030f90455c6b7
SHA256

a8e9655510906994fdef3993bebabf0a5e0b6604f02c0ccc28fd31be3aa684bf
SHA512

85038570bb2fb39e7ee8994ccb3f8f9203c0d8360fea889d238c13b3b49a7ab85488edd01d3ec7e37288ffbd0db7e84cfe0353e199289a854311d27990cb9eea
SSDEEP

1536:S8RRcfSJKxaWWWxVz7MW/UXFue/mu67TPxvn:S8ZJKxaWWy57eVue/mu6fx/

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Elevator.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elevator.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elevator.exe

C:\Users\Admin\AppData\Local\Temp\Elevator.exe
"C:\Users\Admin\AppData\Local\Temp\Elevator.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:784

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact