9e364ccf2384a19973de23c0b730e50a84a250f915e09253e77740baa69eb9bb

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 09:20

Target

Bin1799/Plugins/ShellCode.exe
Size

48KB
MD5

48d69d71ba46f637d29909b3f1d3f662
SHA1

7ba3e41427dc004189021bfb3124cd3b4040986c
SHA256

32252e055c788f2424f915f4b89826bb249d98e003c29828fe6c34c0dcae6ba7
SHA512

443b66bac5d74a1beb50f040833ac32bc9c22c54331a0a71d14775e1ee2b86a7b19114200a653769ba01aed687c56f1cf241b9a72760dc3013efb5b71417b7ad
SSDEEP

384:OF5HUh5h39WoJgNFqb+wSgaVg7UCbSh0epVgzEvti4nRyKAcbQrWt2uq7QcH:80FbSjqb+UygXOZNRsyQSt2uq7Qc

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

ShellCode.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ShellCode.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShellCode.exe

C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\ShellCode.exe
"C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\ShellCode.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2880

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact