df9a20022998c7ac11af23fc69f5d42698ed187b4d03b75fa911570c648d9642

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 14:43

Target

install/Au3Check.exe
Size

192KB
MD5

2868e341097eba28e5f2c68fb20719c5
SHA1

b00356e7e3bb7b6fad8b9940bd0f7cf76ced366b
SHA256

29961d25599beb991e131c9d5d53afa007273366a8bb3b50d380c165f4214ed0
SHA512

018c4d0fc3c783c2df0bd2e885ef3014ee6984f4177b33b5630538ca70cd8bd3622e03f3fb228d864629a1a2b0e19910a756e5f6394a9e1528a621780588bb2f
SSDEEP

3072:BfrV5EAVMczsELz7VBpTjGuX7GVdw3ELPU5+WYPwmsDx5T4XT3CAOA3Gei4:trLEoznVBtjGFPy8wjNADl

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Au3Check.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au3Check.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au3Check.exe

C:\Users\Admin\AppData\Local\Temp\install\Au3Check.exe
"C:\Users\Admin\AppData\Local\Temp\install\Au3Check.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2360

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact