c5beb701e793be49311d476975c0c8b3e453ea5f20d427c64c0d31c3b01a09c1

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Hfolder/Hfolder-key.exe
Size

18KB
MD5

a0192c370370f7adccdd16d81e68dfb2
SHA1

f199e775b28ae613ec3a81127a85e48b2d567688
SHA256

ead9c6ee85cd4feb5a8c8019a857ffb56188b688f04bf80f3361679c877b0b0d
SHA512

f534fc05bbbeaf94f92689f5e6f417b457d8808d16a5a37f9475c450720a2595da4471a9884c6fbef75c054e696aba2d9531aabeb79ac101c4a956a1d4c0ac06
SSDEEP

384:bQ00crMPJYnnFMCKe9L628JaPyYXn8b39z966:000cAP6nKkL63kE9z96

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfolder-key.exe

C:\Users\Admin\AppData\Local\Temp\Hfolder\Hfolder-key.exe
"C:\Users\Admin\AppData\Local\Temp\Hfolder\Hfolder-key.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download