f506283a977ec299e3214d95f9ac6df537b5a72dc5ac3fc8826f99dfcf83cd36

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3858eb19eef2494414fa4b153c0707b0N.exe
Size

468KB
MD5

3858eb19eef2494414fa4b153c0707b0
SHA1

945b087a63f156475743c82748520477e8d5c087
SHA256

f506283a977ec299e3214d95f9ac6df537b5a72dc5ac3fc8826f99dfcf83cd36
SHA512

d80336c6e3d3942c8efb0298ef9841419144865bf2299b09f087ca15a7b0921fea326904b971d6b3fbd35465435ddeb8e799c8c6c08ae193c6a0c3d944d43749
SSDEEP

3072:ttAuor1d603PtbY2PzcIffT/ECpZtuHpnsHEdVhcbOKaySq7tBlv:ttZoSOPtBP4Iffr4LabOJdq7t

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3858eb19eef2494414fa4b153c0707b0N.exe

C:\Users\Admin\AppData\Local\Temp\3858eb19eef2494414fa4b153c0707b0N.exe
"C:\Users\Admin\AppData\Local\Temp\3858eb19eef2494414fa4b153c0707b0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...