de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b

Analysis

max time kernel
145s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
Size

4.7MB
MD5

6d59db4a9c501af6e86c152d1144a3f1
SHA1

49aa3a3f1aa6feb79c29377df3f5f95bb8cbf495
SHA256

de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b
SHA512

d67bf12e8c8fec0fc6168debd653ef258e5c81c1d996d357391300fab1c77cba718d02921b3d4c0e5df8bcce4c1586a8243ee9552e0e0beee5a77344096333d0
SSDEEP

3072:v0WfyFJy3Cj2bCpVre7AVuGpjH9YV2J/d8YNHlw4atTBfln6zGRL:cTv+GxxjGVW/dlNHO4atTBpWGRL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
2068	de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe

C:\Users\Admin\AppData\Local\Temp\de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe
"C:\Users\Admin\AppData\Local\Temp\de971a41c6f31a70fd981a34df39f2910af1569f0d6730debd94cacbde4bff9b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...