cdf7704604f602522cabff38f75509469d80e53cd8f9a716d1c4faa02bd36851

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 01:26

Target

updater/NvStWiz.exe
Size

432KB
MD5

9e82e3b658393bed3f7e4f090df1fbe7
SHA1

bfff954b8ef192c01af9fb5d9141a21279cb9c31
SHA256

c2ad5bd189df04b39be18dec5cd251cf79b066010706ad26d99df7e49fd07762
SHA512

de6a1e62d4e33f807d9c04f355a762717eedbcf540e747a97ba824871d4a1f144f4929141df333711d42af01e441dbbcecbb25a6a4f8ec073a024d94197b776b
SSDEEP

6144:9S4bS5XFvti0A0YqsAtMZDeJmdzh8KL5g3AepeV2fbRahYzUM3:9SMCXFFe0YqsAtEeJKCqN2jRahYp

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

NvStWiz.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NvStWiz.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvStWiz.exe

C:\Users\Admin\AppData\Local\Temp\updater\NvStWiz.exe
"C:\Users\Admin\AppData\Local\Temp\updater\NvStWiz.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2912

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact