d60f1cddbc697efa1d9123e28684ccfc2bf9f59883205485920a5e86874c5cb8

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

FAH.exe
Size

248KB
MD5

51268b890d4e35437667ae6186640158
SHA1

fbe0c05687392003c3fec5eb074e4a7e682d871c
SHA256

e734b35f4dab68e9242eac44249ed9c39ce581b8a83492f085591c04705c68df
SHA512

0c8fa3bfac1d6776524f9bb7928415517a8e8d397ee4ef05c20963eaf023f9f0530d191625506814cc94082a3813c2ff9d42ff65fe866233399450bc5a67375c
SSDEEP

6144:pTi7BucU6Adaf0lBetvSi7QBdRu2tuGCcY/CNQqH:pTfl6AdAtzQZpu9y

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FAH.exe

C:\Users\Admin\AppData\Local\Temp\FAH.exe
"C:\Users\Admin\AppData\Local\Temp\FAH.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads