9d4185350aa546521d0e13f615bbf9952cce3177e107d00c40498f1561221e46

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-09-2024 11:33

Target

$PLUGINSDIR/[RANDOM_STRING].exe
Size

225KB
MD5

88e722490790192e77ea4914457f854d
SHA1

d9512a50c974bf22ee763957140dc01b62f45f73
SHA256

21e870a59c39b7eec4048d2e9d8da3d6e060de63e256662bbcd4eee4ba6d1877
SHA512

e3bd5680623145f473254fa541d62d8ad29e186d97cc679bad54bc21236faf7fb4f929c9d44a2724aa3ad61cc4bc706cf155ba88076f4a717565e2b7cf683617
SSDEEP

6144:3Lbii5bkgVuN+xSKV7Wkrsf7Lsc1BQ+Re9W64R21WUG:3XikbkgaISKV2BQFLyy4

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

[RANDOM_STRING].exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [RANDOM_STRING].exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[RANDOM_STRING].exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\[RANDOM_STRING].exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\[RANDOM_STRING].exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2956

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact