0c8ec6b3108602dc7ec85538d47c2c26b17ade8cf73022eaf1852654fca3803a

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2024 05:51

Target

avgdumpx.exe
Size

626KB
MD5

05031c77d92dad682f0ee4daa9326d0f
SHA1

00cb4efb539ee703f8da08a692e838f675002874
SHA256

7ce6be1803c6e8de08dabd4e38e4220c45801fe028d3160ea21a26ca89c0a22c
SHA512

959710693082dc0e8968ed1897c354b80fccfa3052bf46f3f13addc19ca43c6d5383aee61aacb1112b7021a3893098ac4b1a54cbf5fc05ce91f1e4c656a9ca1d
SSDEEP

12288:+YcnZJjzUuRc0/2WOdhmRXYvpvlGl0KvN+fzmnxJhEa5p+:+vJkuRc0/2pc4llGl0KvYzSnhEaX+

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

avgdumpx.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avgdumpx.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avgdumpx.exe

C:\Users\Admin\AppData\Local\Temp\avgdumpx.exe
"C:\Users\Admin\AppData\Local\Temp\avgdumpx.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1756

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance