74ae6f1ee17959064c9ceed0af1bbdf49d787860943967f9e936b9da2282f465

Analysis

max time kernel
138s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KwMV.exe
Size

329KB
MD5

8283750591fc2ae6a7cb15d8d13f0301
SHA1

2d2743481cd4670e61d7e044694c5036be7e3481
SHA256

46041c33bc2ccb2583ccd6dd7ef303bd74d1d66305f921f51909632a6986532a
SHA512

772fe4b5ea436a4ad4a38801730f11b1755cff3d6e0bf122207f3c58b9acf4803e246af582d9f3ca2b38dadf43d6849f9a6ef540e8d148af58b11aedd810ac1a
SSDEEP

6144:JmsOdG0x+Jqbv7IVUw9/Z4MjNeBe8d7iRMZjsKTBJRyUOfvhd2/9:JKdG0Rbv72Uw9/Z46Me8d7MMXT7RyBf8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KwMV.exe

C:\Users\Admin\AppData\Local\Temp\KwMV.exe
"C:\Users\Admin\AppData\Local\Temp\KwMV.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...