11e29b60e2db984c4f9f6327b3f34037edc3c39a2bf79586db1ef969b973c4e0

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpeedFan/soft2cn．com汉化说明.exe
Size

167KB
MD5

d5a0206baa760324e88f6a73012dfe86
SHA1

427f60070836dbf394e56e058d54394603b64e84
SHA256

b9e169dadb66528aac98472afe7191c9307ff6fbff11b19dc980bcbb594a7168
SHA512

ef7ad60b4ed7ab636389d0e2c06b1ada118da6f4b21abe6d0e4bdc677f833cb279a033b8a0df5659b8f72531a02c45cc7fcea815f8d12450d41ab03b0cdfdc46
SSDEEP

3072:6uf1iBdcYXYdbLXW/O4WLJoPfxCtvLqwVflDPd/qdH:rswr4OJonQxLqwplD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soft2cn．com汉化说明.exe

C:\Users\Admin\AppData\Local\Temp\SpeedFan\soft2cn．com汉化说明.exe
"C:\Users\Admin\AppData\Local\Temp\SpeedFan\soft2cn．com汉化说明.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4124,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3768-0-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/3768-4-0x0000000060000000-0x0000000060030000-memory.dmp

Filesize
192KB

Download
memory/3768-5-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download