b99d75656ea35744e4c1da387084330513a9e286de2f9a908c883589439dd523

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b99d75656ea35744e4c1da387084330513a9e286de2f9a908c883589439dd523.exe
Size

532KB
MD5

03b3f8caf83b6c0104afd2284385413c
SHA1

44cdb2b1b9a323624a9fc18c140af986f99d84e0
SHA256

b99d75656ea35744e4c1da387084330513a9e286de2f9a908c883589439dd523
SHA512

f0c7206beb508ec44a41a9269745ed0dd082a40d4830b4a2e5ea1eadf54fd16af94d8f71768b489a62993159f0e823c617c7ad2b63b7d07469e02e55336511f5
SSDEEP

6144:ddf7fztZHb6Ll5dt4VNCHW1DO7MuL6ISOKQ+:N5gl6ZDovVEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b99d75656ea35744e4c1da387084330513a9e286de2f9a908c883589439dd523.exe

C:\Users\Admin\AppData\Local\Temp\b99d75656ea35744e4c1da387084330513a9e286de2f9a908c883589439dd523.exe
"C:\Users\Admin\AppData\Local\Temp\b99d75656ea35744e4c1da387084330513a9e286de2f9a908c883589439dd523.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...