0f1b99e50b2ffb8f87308abda6e3e50b6deb2377cc21920489704c0852f6bee4

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f1b99e50b2ffb8f87308abda6e3e50b6deb2377cc21920489704c0852f6bee4.exe
Size

692KB
MD5

4b12cdede9c10df05585de79bafa6f3b
SHA1

c7b2c22718fb0a0037ac67f964ac43ed784f4e53
SHA256

0f1b99e50b2ffb8f87308abda6e3e50b6deb2377cc21920489704c0852f6bee4
SHA512

52bdb7591544598cdeafc95a6eda1e9ee67662da3340f1f2a33d1bc55dfe07d95b4636743c5a846ee8f635319352e7293282b92eb40c1ce38902c2a540442256
SSDEEP

12288:UQCCh1TaLSSKrPD37zzH2A6QGgx/nstpq9KgER19zrNidbDgUHayxyF:UQPh1eLSSKrPD37zzH2A6QD/srqggEFX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f1b99e50b2ffb8f87308abda6e3e50b6deb2377cc21920489704c0852f6bee4.exe

C:\Users\Admin\AppData\Local\Temp\0f1b99e50b2ffb8f87308abda6e3e50b6deb2377cc21920489704c0852f6bee4.exe
"C:\Users\Admin\AppData\Local\Temp\0f1b99e50b2ffb8f87308abda6e3e50b6deb2377cc21920489704c0852f6bee4.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3420-0-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/3420-1-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download