1b80d636fb9204b3974d0d9ed88f1e342a1ad198b0f1caf4e37e25198b126d2f

Analysis

max time kernel
17s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/FGet.exe
Size

52KB
MD5

aee371b287d879be8e0e861fb380b1f7
SHA1

265d7bba1a96decafde9d0946d0b8f46f70990b1
SHA256

798add076e955c92841dd403ababac33e6bd86d85cab93816a16d1b5e5925573
SHA512

fb6042b5c09768945760da537f2710f05966765a6b7400737ec4ac4b48e241a2e06c6b7e7f20db361265e81beac18500b690534a6c6a4d0b2027093ab9b47814
SSDEEP

768:+hLzLxQuDxeCOdq+vhpoxk+keOzxqsVYd:+hXlQ1COU8+fKx0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FGet.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FGet.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FGet.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...