c0cd9a7f2987c7eca65906f7f210c53f88055822a95f7833333d3c8a3c3c43fa

Analysis

max time kernel
1323s
max time network
1173s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-uk
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-uklocale:uk-uaos:windows10-ltsc 2021-x64systemwindows
submitted
21-11-2024 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

дрова/Rar.exe
Size

319KB
MD5

d74a171cc22654090ab5e639f41b3762
SHA1

fe815429eab238e6426f7766bcdbd7ca207a3edf
SHA256

bdd8a0d1d99fda28dcde661b6bdb7eb6576aa97655d869b14c2a105106594eb2
SHA512

277c16645cbe392c83faf3638d17c53b0695783b8fda1287232a0808565f598b694924308730fefdb1a9adf76acd5712a203a888874af6b772b5a526e3926ade
SSDEEP

6144:Crugh4eBm7vbQlCwPakaBstCRvIX6kth2mbh74N:CrlNQ7CsBkCRvIaN

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rar.exe

C:\Users\Admin\AppData\Local\Temp\дрова\Rar.exe
"C:\Users\Admin\AppData\Local\Temp\дрова\Rar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4208-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download