e8e3882b3c81967a9a4ffff6c91b11b2525776f502a3284d8f70bf12a11eca6a

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 14:37

Target

$PLUGINSDIR/[RANDOM_STRING].exe
Size

225KB
MD5

64d87448913ac69cbe2babb0bbf78aa8
SHA1

d544762a2720f2b758fc023759866570e7f2866d
SHA256

6fa3a522d948c83f78932b26ffbf0ef2ef790537d31927dd67ef58097cd075a7
SHA512

1f6036699282f3d2fbc4d7ecdc1183dbfac9b55e80f04bd7b42e79817050cbeb1a340db7d7cb527ac2fe22eafef1302e201500568387c3b7681aca42db54d182
SSDEEP

6144:3Lbii5bkgVuN+xSKV7Wkrsf7LsTuPG+tFv0wVHFY:3XikbkgaISKVz7+F8wFFY

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

[RANDOM_STRING].exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [RANDOM_STRING].exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[RANDOM_STRING].exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\[RANDOM_STRING].exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\[RANDOM_STRING].exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2956

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact