1d677741ad3e892d6d66d18839957880e9d1344793a1ce1537bf5161a71cdc09

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ПроверОчка/Последние папки.exe
Size

93KB
MD5

1a7524a3f7443c3e041774d5f372142c
SHA1

b7f4ce125731505cb4961df217465ef6a94c31df
SHA256

e000c782af989e016efcef1664b9d652b0fee59b011e28154072f7b6001b124d
SHA512

3a3e4412727086bdfea85cb9da8d8994ff2f37aa4c761458ba0006dfd7e6fb72b313940eec5ad197b1026e6af4d10d72cbe85c99e3a245ba2c18141fa633ec19
SSDEEP

1536:zuHXbO8QQlS6sAS76Ffm4O8cwZN1L2k27Ruc5Jqbia:zkXbSQhs176Fuh7wZN0k27Rucu5

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Последние папки.exe

C:\Users\Admin\AppData\Local\Temp\ПроверОчка\Последние папки.exe
"C:\Users\Admin\AppData\Local\Temp\ПроверОчка\Последние папки.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...