b6552eccb0e66a59673e1d3fdce934ed643ce72cb196cb76b08664361814d7a6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 22:15

Target

$PLUGINSDIR/[RANDOM_STRING].exe
Size

225KB
MD5

688b4b4aa0d5d6bfc2381158240c1c06
SHA1

dee92dcc8916f9d8e747617f8d425d9ce667f634
SHA256

a69ef73a9ada2648c91d46571b4a605c5c005742ba22b63f43420782d6af68b1
SHA512

54eda643a9c6162460b331f42f565dfa2c46d0af043d73e90d5bd1d9ecbf84a1469cf87030e7074cbe9de1ee212e8c12aa633c51f8c1615260c59ee08bda5ab7
SSDEEP

6144:3Lbii5bkgVuN+xSKV7Wkrsf7LsFFnu4xc2:3XikbkgaISKVlFuo

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

[RANDOM_STRING].exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [RANDOM_STRING].exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[RANDOM_STRING].exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\[RANDOM_STRING].exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\[RANDOM_STRING].exe"
1⤵
- System Location Discovery: System Language Discovery
PID:316

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact