71bdc986994ff0ac066342f524ec84e994ad9240bf80f97759d102e31fbf660a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uninstall_NSIS.exe
Size

193KB
MD5

ef5d5d2f7561199d6f3180412f8142f2
SHA1

66a53ed6629d7179c45464584de70ef81f82aed0
SHA256

1dc870fba5f9309088728c68127fa8d208841078db9aec53ce36e019bc353bfa
SHA512

189afa172b9e7c42bf304a62954afe0966a0d465f8c7a691ec142ccd82f71249bc1f06864acd919bfd54416497da1e1c90075301443d9e1b25b5b2c43dd01e72
SSDEEP

3072:SFOMGpkQnjShPcYxubY5oGBpiYZcDTUYuvlmjx5PEV:P72uUpiYO6Nmj7EV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_NSIS.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3000	uninstall_NSIS.exe

C:\Users\Admin\AppData\Local\Temp\uninstall_NSIS.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall_NSIS.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads