7b199e1df782e348b83e8c275cd7493d6c7e1f0c9863b3a16ec96ead54d661fc

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b199e1df782e348b83e8c275cd7493d6c7e1f0c9863b3a16ec96ead54d661fc.exe
Size

1005KB
MD5

be64d6b422d5d19e740324faf8a84aaa
SHA1

2b8db1d7116c6e56ec4636552297aae3a7b41236
SHA256

7b199e1df782e348b83e8c275cd7493d6c7e1f0c9863b3a16ec96ead54d661fc
SHA512

1c3a79f535db820d029cb8c93f9ddd62aa7b7f7143e47740df4982bd5c433c32249be7fe24dba159c559d9ffd92658b93ca63331be9eda68c2a6255284bb5f74
SSDEEP

24576:JQ1OIyYqCfVk4Ym/jTnGDcZELIveNN3p1E0:JQ1Q6y4YmrVeNx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b199e1df782e348b83e8c275cd7493d6c7e1f0c9863b3a16ec96ead54d661fc.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2472	7b199e1df782e348b83e8c275cd7493d6c7e1f0c9863b3a16ec96ead54d661fc.exe

C:\Users\Admin\AppData\Local\Temp\7b199e1df782e348b83e8c275cd7493d6c7e1f0c9863b3a16ec96ead54d661fc.exe
"C:\Users\Admin\AppData\Local\Temp\7b199e1df782e348b83e8c275cd7493d6c7e1f0c9863b3a16ec96ead54d661fc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-4-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2472-3-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/2472-2-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download