0014be76ddf2f570078c7ecb9382c860ff9e0189d5b53c0a57a5ef319080a346

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0014be76ddf2f570078c7ecb9382c860ff9e0189d5b53c0a57a5ef319080a346N.exe
Size

102KB
MD5

9ab13942b34ab384bb6d5577cb223690
SHA1

e9140bf07ad854aea4198312426a50ead1f5799b
SHA256

0014be76ddf2f570078c7ecb9382c860ff9e0189d5b53c0a57a5ef319080a346
SHA512

e127882293a851813e4120c45c849bbf460e0021aa5d653bf14e63d8cc9a2cdcb3639440384c16433d58c776ec651ccf95e4e90e5b1864a6b9bf0f044c308505
SSDEEP

768:W7Blp9pARFbhs101OlkYlk0l3laHnHUMnujmKK9bYroWAYTYnGaqe8VPH/3HTR:W7Z9pAppZY1aH0MnkaERT+G9v/9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0014be76ddf2f570078c7ecb9382c860ff9e0189d5b53c0a57a5ef319080a346N.exe

C:\Users\Admin\AppData\Local\Temp\0014be76ddf2f570078c7ecb9382c860ff9e0189d5b53c0a57a5ef319080a346N.exe
"C:\Users\Admin\AppData\Local\Temp\0014be76ddf2f570078c7ecb9382c860ff9e0189d5b53c0a57a5ef319080a346N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...