0db2dec89b2077c4f25a662e7b0e3dd4c8e618fa261e6add5fbaf2cae382b8e5

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Notepad++/updater/GUP.exe
Size

132KB
MD5

0fad4b26b524b1341834a9a563171d4b
SHA1

53b3c5c1b88bd003962d8a38ded6141e7cf9758b
SHA256

dc4563880ab9b32ea6f64bc3ebf0580b2cc98bf5d53f8810480b2025af447b87
SHA512

6cf4eac2a692613915e89867ce35ad5e2b001f72da1a9c684171a5509dffec772752a05080701246f2ff950fc91bfb0e89ab1cca85d642597e7df53c63e231af
SSDEEP

1536:UwHGLRMvMlramP7DbA1VSfDQx0bzyEgiytTPu7CUWyhkm27/NOKz2eiKRntR2f:U9LWUhmgDXegGKv0gFKZtR2f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GUP.exe

C:\Users\Admin\AppData\Local\Temp\Notepad++\updater\GUP.exe
"C:\Users\Admin\AppData\Local\Temp\Notepad++\updater\GUP.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...