6ed5d50cf9d07db73eaa92c5405f6b1bf670028c602c605dfa7d4fcb80ef0801

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pspasswd.1.exe
Size

216KB
MD5

427214d675b6bce9f273eb2dde0aeefc
SHA1

423d9b37ef7155c3c36b71ca7f3e6ae154e212e8
SHA256

6ed5d50cf9d07db73eaa92c5405f6b1bf670028c602c605dfa7d4fcb80ef0801
SHA512

f8beeaf4ff4120b9fdd54e5e68bb49718b3a591bbce6c7c5ee5761ab1a89f43559e818be5562974cc50c4234d2ee38478b1a41f143535c38a7eafc22ac074a92
SSDEEP

6144:/qau0x6EJpB2E2GNoReumgb8HAOBMo6/fI:X0aB2WqeumB3m/fI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pspasswd.1.exe

C:\Users\Admin\AppData\Local\Temp\pspasswd.1.exe
"C:\Users\Admin\AppData\Local\Temp\pspasswd.1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...