899ee0b7cb4b68c957483f83f35f706588a738086cc479cc74f4b594f477fd85

Analysis

max time kernel
92s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
899ee0b7cb4b68c957483f83f35f706588a738086cc479cc74f4b594f477fd85N.exe
Size 155KB
Sample241110-m2pkhavglr
SHA256 899ee0b7cb4b68c957483f83f35f706588a738086cc479cc74f4b594f477fd85
MD5 4eb8719e38cccb7a2f9b4059f103c650
SHA1 065d8939434781ae3142600f27cd1f7d6aec12d6
SHA512 a51540aaf68fbc43596b51ddf471746501fd9904174c47377c5d47a5ec3e4d9deffec3341129aef4980196cfe9ea052e8d903bf0d988739779b5f2643c766f87
SSDEEP 3072:IWG/tlaUGbeEBU5+/SFR8JzbrRn7y4CW1Z3uXab0IGtHn1ZRTX4hqJBMNr:ZG/raValqSv8BrR7nCWLVb0zHn1fQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	899ee0b7cb4b68c957483f83f35f706588a738086cc479cc74f4b594f477fd85N.exe

C:\Users\Admin\AppData\Local\Temp\899ee0b7cb4b68c957483f83f35f706588a738086cc479cc74f4b594f477fd85N.exe
"C:\Users\Admin\AppData\Local\Temp\899ee0b7cb4b68c957483f83f35f706588a738086cc479cc74f4b594f477fd85N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3644-1-0x0000000000400000-0x000000000042C000-memory.dmp