8c081c225152b8bf0766c73f4159feb37e512428a0cfd0e7f514fb258bfa83de

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mystery.scr
Size

37KB
MD5

5fe75033f7c45cad0355b811f19894b0
SHA1

51bf053d174ee66b5f118d2ff079353d91537b77
SHA256

4d4709153a4e4d7bc7d0ee7d2ad2bb509d0c64743ed284ef7d82968005134fc8
SHA512

bce3427ea69369366d648fe28fd1dfba3c960b61a39a8a4d010adf6fa84ddfbaf37a240633a4c139676a8ed30513a7e0965089a53b2a386b522935f60bfd9ac1
SSDEEP

384:gGaBoCR6xUrDLM8g3JpkeVppEC+VV1+dTqsUzQzRvQbyNDpQnOPdPMjgtXurbsQc:raBCyfe7pEDDgdTqY6a9aO1PB1Ir6s

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mystery.scr

C:\Users\Admin\AppData\Local\Temp\mystery.scr
"C:\Users\Admin\AppData\Local\Temp\mystery.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4348,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download