f1946def9c8188e766941dc793c6d7385d02ea9d21888f41d0ef86379d0c62ac

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1946def9c8188e766941dc793c6d7385d02ea9d21888f41d0ef86379d0c62ac.exe
Size

11KB
MD5

f0f2699c04d332e169c8f33cfe460706
SHA1

35164231eec7d2e8ebd87b40e7001c77db0d592f
SHA256

f1946def9c8188e766941dc793c6d7385d02ea9d21888f41d0ef86379d0c62ac
SHA512

92601cfd42995f29880f31bd0f589131ed7ad7904ab978e1f6d28473c4ce3beb351819ee1d21418ea0c8186e2c7850a7d400bb42ade505056385899155cca904
SSDEEP

96:EYc0wV01XfSGMKBst+cqlVTJlHcQlgq/laYUXmtEpLmiEFUkputsW8r:UqhtMK+unNpp+Urgn1miEFputsZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1946def9c8188e766941dc793c6d7385d02ea9d21888f41d0ef86379d0c62ac.exe

C:\Users\Admin\AppData\Local\Temp\f1946def9c8188e766941dc793c6d7385d02ea9d21888f41d0ef86379d0c62ac.exe
"C:\Users\Admin\AppData\Local\Temp\f1946def9c8188e766941dc793c6d7385d02ea9d21888f41d0ef86379d0c62ac.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download