895bb49bd055a61773b0c2f5d26397f43e8d94d299f190952d2883c9f36b24b0

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

895bb49bd055a61773b0c2f5d26397f43e8d94d299f190952d2883c9f36b24b0.exe
Size

1.7MB
MD5

50dd435789d45bb151f0b3c94e0cc13e
SHA1

86be1ae5c0ec9a51f00e5919dea110bb3d6521fb
SHA256

895bb49bd055a61773b0c2f5d26397f43e8d94d299f190952d2883c9f36b24b0
SHA512

45f0d48458e3f905e26f9b604ef55dd7c75741a99d98fa404e4466085092604a9de10ae6e1e207fd696e921c6384e58ae24f3b8ba5efa7af9eb9d986c0ef2fc7
SSDEEP

49152:/+2cUIGnB2+VkGSXlSsjSzdMFO8ezFP+9Y/Az1UXkB5qhjWxDRXdQg:YfGnBTVoXl3SzdMFOpFP+9YZXkB0hjWr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	895bb49bd055a61773b0c2f5d26397f43e8d94d299f190952d2883c9f36b24b0.exe

C:\Users\Admin\AppData\Local\Temp\895bb49bd055a61773b0c2f5d26397f43e8d94d299f190952d2883c9f36b24b0.exe
"C:\Users\Admin\AppData\Local\Temp\895bb49bd055a61773b0c2f5d26397f43e8d94d299f190952d2883c9f36b24b0.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...