0c8ec6b3108602dc7ec85538d47c2c26b17ade8cf73022eaf1852654fca3803a

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2024 05:51

Target

avgcmgr.exe
Size

616KB
MD5

c72ce5b8e86f4a0fdb4853747932c771
SHA1

06dc956843a7f1ed443a7cc6c6ecf7589ffe06f9
SHA256

acb237852105b72ba5b5429dce59f4efde0ffa936748a15f6e0746c63cea165f
SHA512

b332ddc34fe8e3cb8f60aa975ec0ac5362f873ba95b3f887e2c54356e54d69ff124ea4009f61a7cd98fbb212549288b8a1b0cb340e66df175db79941ff7fb848
SSDEEP

12288:Gy/6IPU+rWp3gSnRjDtsYNpBFWkRui/i/Ktqmo+TM6qkslWwRAlrrkmXcf4qzd:16l+rC3gSntOYNhRuki/+qm7Ti0wRAlE

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

avgcmgr.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avgcmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avgcmgr.exe

C:\Users\Admin\AppData\Local\Temp\avgcmgr.exe
"C:\Users\Admin\AppData\Local\Temp\avgcmgr.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1672

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact