1a79f996f0f4f9919814e0bc2fb2a413feb4e75af72ca80c3af0c89f9393f3d0

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FilePulverizer.exe
Size

2.0MB
MD5

264dbeb1c42a0d984b9bae6228a624f4
SHA1

bbfe3a78b3f682d625c086aad548afccb58b5f9b
SHA256

5c80007ac70fc6a5d4595531bb4896c75b7c5497311ba113d8727eaabd7dade9
SHA512

6f4753ba9dcbcb158c124378f6ab11f711291ee389736f80e65c3895afdd5960d6977c617369b974f3f01b4dead22ae58603e2364285b81032f6fa4567fd4ecf
SSDEEP

49152:EcRJD8MiSKP0ydLSLY8poj09orA/DTbXX6GCp6IfK5CM+gT0h2VZTA:JySLzoj09orA/DTbXHCvfKKWTA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FilePulverizer.exe

C:\Users\Admin\AppData\Local\Temp\FilePulverizer.exe
"C:\Users\Admin\AppData\Local\Temp\FilePulverizer.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2360-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2360-1-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download