e27a3a7f8a32f3cd4b44719a6857152efbf049a59868eebd70243218f51787d6

Analysis

max time kernel
94s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMPImg/regver.exe
Size

290KB
MD5

9181b183dd3096301e7211ed0312de8a
SHA1

0c321747b581ad79da70dc9aab183cc12c3bbefd
SHA256

202fcecc53f1ffd2d1d85cc4cc79a24ae37285ce564e15615b5d13ca69487968
SHA512

5316e0511746c75603ba02eaf79b9aafbb29356f94279f466d3f17e9894082f14cf052ca3b8f52a149815e8c9b58f5d4b02ef1dcc3d677dc27032480f788adf7
SSDEEP

6144:hIPYFHLrOWl1uIQtbf2QVDZEY4KUC3VM7UaEHpTLNUqNxC2kOoKXl:h+YFHUtbOUeKt3VMQaEHpTDx/kOX1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regver.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
384	regver.exe
384	regver.exe
384	regver.exe
384	regver.exe

C:\Users\Admin\AppData\Local\Temp\$TEMPImg\regver.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMPImg\regver.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...