f71a14b96062eb23f29adc40a91697b96875e5b6bd0919c1d41a815539a1e1d2

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/minibar.exe
Size

588KB
MD5

ea75b9dd5884e2b343fb3772ac9d23c7
SHA1

1ba7413db7181c2407c22e16a06744366778c550
SHA256

77948dd5780b2c0f4d9ab7e775579a707016beb1251a41a727701be690b09982
SHA512

ea25edc0467c915c7c24faf2b6085bddfc76179825bb809bf3097166b3be90d07463066833557f439c0b35aa446f62684ac482433b384f914185c829fbc6395a
SSDEEP

12288:7Cog8XMjQnPzj+eKqsZ02ryZjVkI+EDBf6ZH1a4VwynTnQdLjJ8eb:7C7onPzj1sKTZj6I+ifUHhVwgQ7B

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	minibar.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\minibar.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\minibar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...