73aac3c537761e667a5de139f90d5d99cdde0e153e5c6370da81e385bc7d46d6

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 06:57

Target

73aac3c537761e667a5de139f90d5d99cdde0e153e5c6370da81e385bc7d46d6.exe
Size

6.9MB
MD5

7f41fe3e70e6068b9c13c3c8738a8364
SHA1

b771dd2692706996956a2def154755d41866ec6e
SHA256

73aac3c537761e667a5de139f90d5d99cdde0e153e5c6370da81e385bc7d46d6
SHA512

44ad69254c96b6e811b061becb536973f2d98f5158d3854ec10aa1f1b725e8cebe329a352e313af4d4bb39026f2ceb1cb16f8bfe90bb220c132a68db68535405
SSDEEP

98304:1MQFHT7U8d2oV/RxNwh8Qj7EBA2F9McNpi9R5sXfOCfoBvt:hHJjxWd7M8cwACBF

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73aac3c537761e667a5de139f90d5d99cdde0e153e5c6370da81e385bc7d46d6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1540	73aac3c537761e667a5de139f90d5d99cdde0e153e5c6370da81e385bc7d46d6.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\7553d415

Filesize
1.2MB

MD5
722b827462e2f3074b693bb0df4e4c61

SHA1
a9ac73c606ee0f926486e8c763e13c5d1ad0cf1e

SHA256
aeb3d1748fe14667b9a847b3d08b9fc86cd831b3f56c90010c6ab1974ce76512

SHA512
573e130f957e3ae7d557fb6981d90d0bd10e2b64109772dd175d7b6c1a3c6ee74782827d0879e471fcd34e6f2d90a77fec3061edc218f52d694380e3f51287c8

Download Submit
memory/1540-0-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/1540-1-0x0000000000400000-0x0000000000B0F000-memory.dmp

Filesize
7.1MB

Download
memory/1540-7-0x0000000074580000-0x00000000746FB000-memory.dmp

Filesize
1.5MB

Download
memory/1540-9-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download