e7c4282ecdd0036cb8976163c369a41fc95fdef2b435390d6bcd3477a549c646

General

Target

2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Size

163KB
MD5

3c3a8c6a192e0cd46d68ab369480aad6
SHA1

faad8f2de0d5e991f0c617b71a613e7b77c69fae
SHA256

2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1
SHA512

727e633f73653850aa85090ff665124d4f178b2d95a8c2521c55c080e4394c658c673400f5501342e63ead0ff9f937244a271880f8f74c1d1235da438df9e236
SSDEEP

3072:Yyyq/FjarKOyyXLh8FPxQUJz9wwE1+t+JkabAtl7j9poJZR1Y:Yy8ydeXD16+JPb9JRY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe

description	pid	process
Token: SeDebugPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: 33	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
Token: SeIncBasePriorityPrivilege	1488	2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe

C:\Users\Admin\AppData\Local\Temp\2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe
"C:\Users\Admin\AppData\Local\Temp\2d7b184bc63715d13321aa385accd2eadb04310d49119b80f5c6d5c686053ee1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-0-0x0000000074A31000-0x0000000074A32000-memory.dmp

Filesize
4KB

Download
memory/1488-1-0x0000000074A30000-0x0000000074FDB000-memory.dmp

Filesize
5.7MB

Download
memory/1488-2-0x0000000074A30000-0x0000000074FDB000-memory.dmp

Filesize
5.7MB

Download
memory/1488-3-0x0000000074A30000-0x0000000074FDB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing