873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6N.exe
Size

140KB
MD5

e2d479b0027b31e9d976c5e561fa68a0
SHA1

2cb55cec4d0206ec27d3c6273e4eebbb72130db1
SHA256

873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6
SHA512

4e9fab7faccece0061a9a344b37cb5278d66bb7bb4a9bf778af4ea0607e91cb1cb17d8603d5053271150157aa0b7b79a03b80d8e4ac06c2d36395f7e7dd9d984
SSDEEP

3072:hs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/w/Fnncrd5971c:hDeM7iNEkgiOb31k1ECuJy5J

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6N.exe

C:\Users\Admin\AppData\Local\Temp\873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6N.exe
"C:\Users\Admin\AppData\Local\Temp\873f4bcf46520ad9dff4c0d18f202ea03ba3dda9586c27b872f1c4b6422a3cf6N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:8
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-AhBCs9NWcSCAbWRW.exe

Filesize
140KB

MD5
56ea036df0c4b53be070e74802f7149c

SHA1
ac30fee2f33180a5355eaffa0af614183e266090

SHA256
8d0b92790d24fc8d0ede573ee3a351e81746dd00a5757e7f134e87c737ec4541

SHA512
fcdae6774ba24a43beb390dea2fed8125407edc879c1878a393d6bd964324d57c6068dd50e3bad71dcc77278db6f60f0fd05837676dee6413c6e4d1ba91e821d

Download Submit
memory/1496-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1496-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1496-14-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1496-21-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download