d98832bfc040c10d3000a9afc90ec9f8d9adcfc12ad45bc6baabfa26f760d97b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Installer/Installer.exe
Size

227KB
MD5

b588f677ab42fdf4fb540d399e0c822d
SHA1

8a23270696d6dc4e92c3afd515ba19fe8fc4bd3e
SHA256

6c5af52675bd86c04c858774dfaecb12d67cbb492b5835ccfb6a41f7e594e3c0
SHA512

3b7ae452c5f7f203135ff382b5d6e8790221538c086934a5857b1819e1aec19d5955a916ea3fbfaa1925b58ac0584412c050c618c5f63171547d4af0c9a27bd7
SSDEEP

3072:PNGh0Mfkarr8cMvFBRqAlvdfcVfw6r4OlqJslIFdATelkIZch+5rixPZad:PN5Mf3pMvRvl0VfLtiF9lzZcU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe

C:\Users\Admin\AppData\Local\Temp\Installer\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer\Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-1-0x0000000076670000-0x0000000076731000-memory.dmp

Filesize
772KB

Download
memory/752-0-0x00000000777E0000-0x00000000778B6000-memory.dmp

Filesize
856KB

Download