ca6f6ef58a3c935b1ea7393d7b52252946c294ab4dfd4f76c5349035184423f4

Analysis

max time kernel
79s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-10-2024 05:59

Target

DrvInst.exe
Size

38KB
MD5

99c2cdd8d5fc858c96a2837650fb2481
SHA1

700fcdcd1dcd1a446f1cf41dfaaa10cafa20df94
SHA256

a0753cb89f3d8350dd4d25ee019092c25d622f5e60b4e536311cc06121104b41
SHA512

813374a8e79b7c00ee3de90003d507ecc81a5e0536e2c4e8e4738cf4029c3116eb5acbdf7aeec63b6dea829d7f008def7109c5f824370e545031cec9e8871e00
SSDEEP

768:4aabzWjWGEh3BXTseXHo78xofEDMAntUMcw8Ou9IENmT4:4aazWjW3B4Eo782Ctanfw4

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

DrvInst.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DrvInst.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DrvInst.exe

C:\Users\Admin\AppData\Local\Temp\DrvInst.exe
"C:\Users\Admin\AppData\Local\Temp\DrvInst.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1120

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact