e5e4bc9b97c9c6fce7178373bd1d6e6204aeca5b0e9af8100cdbcaea9b8a8020

Analysis

max time kernel
92s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2024 01:15

Target

capesolo-0.4.11/CAPEsolo/bin/signtool.exe
Size

231KB
MD5

6581581a1f2eda52d49dc1fb0619ff82
SHA1

c1fee5c60f43ccfcb1d9f0a72d914446e02bb5e3
SHA256

f91d5e8cc6f208e56660292b80ac3837787100306c786b9feba8f0152e1eb1a5
SHA512

dacd128a9195eabd9d8980064adaf28ac9740281d63e78b663d0ce43dd6c45fd3df5e041c325074f89af6cc9f8940dd5bc7a571e913bc27cf7bd696c086be81a
SSDEEP

6144:Wk4PcUOd7ZYKsN4JR7cFnNBPHgeUe3NmC:Wk4/Od7ZYvOD7cFnNBqC

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

signtool.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language signtool.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	signtool.exe

C:\Users\Admin\AppData\Local\Temp\capesolo-0.4.11\CAPEsolo\bin\signtool.exe
"C:\Users\Admin\AppData\Local\Temp\capesolo-0.4.11\CAPEsolo\bin\signtool.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1968

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact