b9968149cdedf77356e26d68d82bc47ac20d11a14763c026ec36b842850b4af0

Analysis

max time kernel
94s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bomgar-sjp.exe
Size

924KB
MD5

1b9486b508ff0b0f35cdc820504b05a2
SHA1

761d9e4e28ce7b27c9c2c09ac75875ab7e49d6d4
SHA256

794bdae691d1d9692d96d5426f708e5a71cdf0202afdb4efdda1dde707f51a07
SHA512

9499c3f0c8aca40cedf15d6414b56be1c13875ced0fa58987b18ad3a72d167d9fbdb3b0bdd22682e4b93c7b1c77413b7ef4bd71a8c7c7a67c02c303fba4b5afc
SSDEEP

12288:4mEELitK6MLzSmMV+JsAz6wEwLTNu5WtTkyYUJQqZXngs4gZYfybEdur1GtTre6F:4GitK6MLzSEJsAmy/tZfbdr1GTre69n

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bomgar-sjp.exe

C:\Users\Admin\AppData\Local\Temp\bomgar-sjp.exe
"C:\Users\Admin\AppData\Local\Temp\bomgar-sjp.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...