4870493ae49e6c0f2eaad25337b2ec1a6c63e5efeac7c2517fbad27fb89f0ea5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2024 19:33

Target

$PLUGINSDIR/[RANDOM_STRING].exe
Size

225KB
MD5

0620e4bd66dca333f93990182f042f2d
SHA1

8b367f1eed05aee9fcdaded4091ee71807842418
SHA256

8842f8c9d02fe1c16a9feaf59865801e4f6c38883144f6a3db95c2b05bd73070
SHA512

6e1423585573c0192e34c99e519eecdb2d780ffd4d41a0d4b297ee2e2d14b5b13874594736273c4e5ed2bf1ca1f60ed0fa28f753ab09cfd766ea9da73328b766
SSDEEP

6144:3Lbii5bkgVuN+xSKV7Wkrsf7LsTl7I3viTienVdfWk:3XikbkgaISKVz0vzQHD

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

[RANDOM_STRING].exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [RANDOM_STRING].exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[RANDOM_STRING].exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\[RANDOM_STRING].exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\[RANDOM_STRING].exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3252

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact