6ba0f2c65d7ecd4632e750430ce92c208e3d4e8aa76806d6a5afaffb569d9797

Analysis

max time kernel
96s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a470d9f9dc42bf862bac1b5f4834340N.exe
Size

98KB
MD5

5a470d9f9dc42bf862bac1b5f4834340
SHA1

92e3858df2a94eee73275b4a7dba38f3c1c305b0
SHA256

6ba0f2c65d7ecd4632e750430ce92c208e3d4e8aa76806d6a5afaffb569d9797
SHA512

3f9b6e5fb261ffecc7206ace7e87bc7324ce333f7272cdc8f65c896471c25830c4f6ecf0cd54be39db49d76a4472f3090dfaffe190f985659481cf002f3c243e
SSDEEP

1536:W7ZDpApYbWj2WTWJe+e/qXhg8Yxe1QNDZG4:6DWpaWTWJe+eQg7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a470d9f9dc42bf862bac1b5f4834340N.exe

C:\Users\Admin\AppData\Local\Temp\5a470d9f9dc42bf862bac1b5f4834340N.exe
"C:\Users\Admin\AppData\Local\Temp\5a470d9f9dc42bf862bac1b5f4834340N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...