3210e6297871181943c10f3a63cc9322d6eb5dbcabfc975ab9607953e9ef1152

Analysis

max time kernel
95s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 20:14

Target

3210e6297871181943c10f3a63cc9322d6eb5dbcabfc975ab9607953e9ef1152.exe
Size

164KB
MD5

2b84f19eb42c6a7ba23a7556dbc7fa56
SHA1

b9b67f21f30493a420e13567816881cff3d9ea4e
SHA256

3210e6297871181943c10f3a63cc9322d6eb5dbcabfc975ab9607953e9ef1152
SHA512

7166c4fe9d252cd55b71c1709a360219ef7b0f7f5638633fbdf59493efed6261e6056ef0b368e3abfdca35c2e6bfa0d0f315ae2cf3faf82ab3c9aa058ae83574
SSDEEP

3072:pJzXRj6T4W/c+wkpGyymOEgNodbeVoTGROMbM+zD7YlfSy:XX+jFpG/p1NodbgSCOUM+zDof

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3210e6297871181943c10f3a63cc9322d6eb5dbcabfc975ab9607953e9ef1152.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1988	3210e6297871181943c10f3a63cc9322d6eb5dbcabfc975ab9607953e9ef1152.exe
1988	3210e6297871181943c10f3a63cc9322d6eb5dbcabfc975ab9607953e9ef1152.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1988-0-0x0000000001990000-0x0000000001CDA000-memory.dmp

Filesize
3.3MB

Download
memory/1988-1-0x0000000001990000-0x0000000001CDA000-memory.dmp

Filesize
3.3MB

Download