74ae6f1ee17959064c9ceed0af1bbdf49d787860943967f9e936b9da2282f465

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KwMusic.exe
Size

4.0MB
MD5

4dc56a99e2452eaf1340ca7101962afd
SHA1

c944ebd5f56647f412e3f33752d8cc256ff033a3
SHA256

1ccf8f947ad8a79dc2b92f12211264ec44dcef68afeecbea96e307764f9d1bbe
SHA512

eeb770cbe039ee3a8fe3fe9c71396567c8948cc883226a9bac263fe02d2bc546aa752e572f54bab71afcad15f408d59e5adbd20735d21ec275014025e7611d0c
SSDEEP

98304:CZq/xmOuzgUzCJAF0WplcMZ5YOKFY2DOmFX5yx6/rZ2WEa1jA9g:0qJWzCJXrZ2WT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KwMusic.exe

C:\Users\Admin\AppData\Local\Temp\KwMusic.exe
"C:\Users\Admin\AppData\Local\Temp\KwMusic.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...