5b69c7eab651ac554becc0d4e3c6ac491396dbbd7bb14d3cc021e9a5bdff92c0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b69c7eab651ac554becc0d4e3c6ac491396dbbd7bb14d3cc021e9a5bdff92c0N.exe
Size

3.1MB
MD5

d0447caaf040e70603a228c2a4a3b4a0
SHA1

668028029a0cfa3812fabcc7fe22575e099916e9
SHA256

5b69c7eab651ac554becc0d4e3c6ac491396dbbd7bb14d3cc021e9a5bdff92c0
SHA512

a567b2d31a0a6643dab684d40349614fafa9c8087bbab36bec7d279d81b6385ad86d8d85b5d09dedba990ad948e996ed190211889b6223b3f5c373c19edac5cf
SSDEEP

98304:0AvAd9yGp338SUPNvuldZzOKsGU0DAo8In+aP:5FG18rNmldrsn0Zj+aP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2528	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b69c7eab651ac554becc0d4e3c6ac491396dbbd7bb14d3cc021e9a5bdff92c0N.exe

C:\Users\Admin\AppData\Local\Temp\5b69c7eab651ac554becc0d4e3c6ac491396dbbd7bb14d3cc021e9a5bdff92c0N.exe
"C:\Users\Admin\AppData\Local\Temp\5b69c7eab651ac554becc0d4e3c6ac491396dbbd7bb14d3cc021e9a5bdff92c0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2260
- C:\Users\Admin\AppData\Local\Temp\7zS4D826BD6\setup.exe
  C:\Users\Admin\AppData\Local\Temp\7zS4D826BD6\setup.exe --server-tracking-blob=N2JjODU3NTEyMzhhMDY2MDIxYTdjNDljMzJhYmViOTRjOTJhMGVhMWIwMmU2NzBhMjE0ZWNiNjQyNWJiMjliMjp7ImNvdW50cnkiOiJERSIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0RFX1BCM19ERF8zNjYxJnV0bV9pZD02ZDE2ZGFkOWMzOGQ0MDRkOWQwOTg3MDM2NTBlNmNlMCZ1dG1fY29udGVudD0zNjYxXzI2NjYiLCJ0aW1lc3RhbXAiOiIxNzI4MjY0MjU4LjA1MjciLCJ1c2VyYWdlbnQiOiJJbm5vRG93bmxvYWRQbHVnaW4vMS41IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0RFX1BCM19ERF8zNjYxIiwiY29udGVudCI6IjM2NjFfMjY2NiIsImlkIjoiNmQxNmRhZDljMzhkNDA0ZDlkMDk4NzAzNjUwZTZjZTAiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI0NjNjOGQ4Ni0wM2FjLTQ1NTMtOTBiZi04MTg0N2EyMWZkZTkifQ==
  2⤵
  - Executes dropped EXE
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS4D826BD6\setup.exe

Filesize
6.3MB

MD5
86dd06e679802c75653e22d0dbbaadf3

SHA1
62ae11a89addd8a9bb4cc4be6e9799dc86103c59

SHA256
8c13e1b66a1f67170410b1129fb7cfa55ef78bc2ef61b246edeaa68f3dfb8333

SHA512
094bfb863c7e31658a68dde41ca33a60271f788ab8d653a7a0aa7b57ccce7c0e0367a60474bf233f45f4dbf56777422ab538c87bcda9c0390e2f49630c3ed80b

Download Submit