627f1b29cfb9ab7a7e03fb872e2c3329f3fac1fe2e54b54976d9791f74453051

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

627f1b29cfb9ab7a7e03fb872e2c3329f3fac1fe2e54b54976d9791f74453051N.exe
Size

468KB
MD5

6d169dbc1d44c91490f668fb0a3990c0
SHA1

0adc29e6d856dd2a885a235bd7297f908bf5779c
SHA256

627f1b29cfb9ab7a7e03fb872e2c3329f3fac1fe2e54b54976d9791f74453051
SHA512

d149c6c55746ff378c89d5a5b4731b2019324dc3b0bad67c4d8ea06830ec074b10e78fad94f593cc41e11379aee723d35c85f62ed6e2100a2f09dbcebd8bdd26
SSDEEP

3072:wq65ogsG5w812bYVPz3y6f8/HCujZILrPmHxvVQNaxI+lyqGEBlN:wqAoC9122PDy6fIOOaaxvkqGE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	627f1b29cfb9ab7a7e03fb872e2c3329f3fac1fe2e54b54976d9791f74453051N.exe

C:\Users\Admin\AppData\Local\Temp\627f1b29cfb9ab7a7e03fb872e2c3329f3fac1fe2e54b54976d9791f74453051N.exe
"C:\Users\Admin\AppData\Local\Temp\627f1b29cfb9ab7a7e03fb872e2c3329f3fac1fe2e54b54976d9791f74453051N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3960,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download