d07bdefcabeb6ef9fd8066d5fd79777225bc0725aef6e737f16c643ae9662559

Analysis

max time kernel
92s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 08:34

Target

filetype.exe
Size

44KB
MD5

1f2eab66674cd1820fcd06a20b0a7ab8
SHA1

0dc9e1b02e72b3f2630e47e715568cfceea9ab35
SHA256

0283ee684729fc204a985e358eea93ae4010894a0a662ffd1267e1e78e9de624
SHA512

066936f34d655ce6d6023dc08182e0d69686528460e003d885b1be0f386021ce8c607f16eb964ad8d3ff56e5a6dce65916abbd93b59c0ba83520574f6849c112
SSDEEP

768:XPy45aRacSB9ivfCw7LjfYV4spkvlS63ul:XBEaHBsfCOLjfmNkvl+l

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

filetype.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language filetype.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	filetype.exe

C:\Users\Admin\AppData\Local\Temp\filetype.exe
"C:\Users\Admin\AppData\Local\Temp\filetype.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:632

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact