2f62a6a00bafbf9366588bcbf678d5e84b11bb251a183163d7661a95f8e4f3b2

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f62a6a00bafbf9366588bcbf678d5e84b11bb251a183163d7661a95f8e4f3b2.exe
Size

78KB
MD5

283c140131da988a9d616b91f394cbbe
SHA1

c068c7fec1d99fa8b1db1ce753c09be8ba4c1a72
SHA256

2f62a6a00bafbf9366588bcbf678d5e84b11bb251a183163d7661a95f8e4f3b2
SHA512

db89daabfb491e0118afdf19c52fba2346bb244aa6a753525ef0bf477a0ef768751f8828c9deaff1bf1c9c4a1c115c2179880e0668dbcc07b3998800d20f4b12
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEi:/7ZQpApze+eJfFpsJOfFpsJ5DdqncJyH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f62a6a00bafbf9366588bcbf678d5e84b11bb251a183163d7661a95f8e4f3b2.exe

C:\Users\Admin\AppData\Local\Temp\2f62a6a00bafbf9366588bcbf678d5e84b11bb251a183163d7661a95f8e4f3b2.exe
"C:\Users\Admin\AppData\Local\Temp\2f62a6a00bafbf9366588bcbf678d5e84b11bb251a183163d7661a95f8e4f3b2.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1572-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download