bd75ae822853ffcc0240a9435ef0d498d69f939c08c66baf4152ff81fd2fa038

Analysis

max time kernel
141s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plugins/AgentSetupWizard.exe
Size

1.6MB
MD5

b2829ba58e289d492f988934809a1d53
SHA1

b9f3b9d1eaa7da642de79949ec1a8950fed2d81e
SHA256

2f071d45487842181b0ba6b9b4b477b1b1e218357a12da7923ae0b99bde9be04
SHA512

b067db14673c8e4d41cd553d09730cd700a228ce4c2aba8335244e3ff73ec6164b55b807274a2c94c30fe02941e020b5ae432127f2452159e5a1e9904cba6686
SSDEEP

49152:m3I8S5l043eaSC9nTqZfRWGMF1EDkzMP:m3zalp791

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentSetupWizard.exe

C:\Users\Admin\AppData\Local\Temp\Plugins\AgentSetupWizard.exe
"C:\Users\Admin\AppData\Local\Temp\Plugins\AgentSetupWizard.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1120-4-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1120-3-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download