900c82f46aa74c6f2a2d262eab934425ac142b83193043987152e5e788c8526f

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RamSmash/soft2cn．com汉化说明.exe
Size

51KB
MD5

73d08a2d48c0a6a24875fbea007009fb
SHA1

490cd52cbd4941a00993c4a3dd99d7e809170326
SHA256

e0d94ff7ee63d172ab99d839ed4a8053067b62776a58996a62e3fb81c8d25b65
SHA512

ad8404baa8e8c34b43cb333ac37ab0f0e210fcc28b364a4ff3c2d3d67376e8f9898cf6cd5fe475f6c8621fc84dd8f68832bbd57169af2771ac7132f198110030
SSDEEP

1536:9g3gJmVb2Y3lnpIzVeTqLm60Ua0dml95pT:9GV/LyVeTq7DE95F

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soft2cn．com汉化说明.exe

C:\Users\Admin\AppData\Local\Temp\RamSmash\soft2cn．com汉化说明.exe
"C:\Users\Admin\AppData\Local\Temp\RamSmash\soft2cn．com汉化说明.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-0-0x0000000060000000-0x0000000060029000-memory.dmp

Filesize
164KB

Download
memory/1684-1-0x0000000060000000-0x0000000060029000-memory.dmp

Filesize
164KB

Download