e9c5fad758c0ffaa5a468f869e308dde53c23348c3d356313474d97662ff9c87

Analysis

max time kernel
94s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 22:57

Target

FilesandTools/md5sum.exe
Size

48KB
MD5

8d443f2e93a3f0b67f442e4f1d5a4d6d
SHA1

c2c8b4e6e8b83c760e984a496b8570d5950e4a31
SHA256

770c0cdbb87b5ac036b79f5a4c48a2535fad71002bc2ffe88120713d4180c3e8
SHA512

0115cfc844b67463ff1ce763429eaacdb56b06217eac1dac381258632e2018437e5e2692b08dc851066c6c4d9764e9884477779f9259cac629921bbd3a0ed618
SSDEEP

768:jePB1YMnfxuBvivHafWguQ2PqDm3zq3a4G9CAmUdZecvDy:j2QMn8Mv+Fx2Pd3zq3TG9mcvD

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

md5sum.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language md5sum.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	md5sum.exe

C:\Users\Admin\AppData\Local\Temp\FilesandTools\md5sum.exe
"C:\Users\Admin\AppData\Local\Temp\FilesandTools\md5sum.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4672

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact