c0aa862f3a3044c877d30fd90fa3ab4104cb4570797d5c13aa413474aa6bbcd0

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0aa862f3a3044c877d30fd90fa3ab4104cb4570797d5c13aa413474aa6bbcd0N.exe
Size

11KB
MD5

2f8ea25cf68e73150cace6df402d71f0
SHA1

b99d9431d9205e98b02fe0fdb264fb8a6f199042
SHA256

c0aa862f3a3044c877d30fd90fa3ab4104cb4570797d5c13aa413474aa6bbcd0
SHA512

28051036a0df0776b1ab97589c324bc145506b15ea04ac17903dbf8975dfc5c6755fe62bb838183ab98232da0b62da2f35b10ee4f69707d7b732752a56b6b82f
SSDEEP

192:RvxJqAPhpeS1ZK4O3CDHp1QyJXzMYu+KYp5U4ubvRxKv:nUAPk21QGMn+KYpu4uFQv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0aa862f3a3044c877d30fd90fa3ab4104cb4570797d5c13aa413474aa6bbcd0N.exe

C:\Users\Admin\AppData\Local\Temp\c0aa862f3a3044c877d30fd90fa3ab4104cb4570797d5c13aa413474aa6bbcd0N.exe
"C:\Users\Admin\AppData\Local\Temp\c0aa862f3a3044c877d30fd90fa3ab4104cb4570797d5c13aa413474aa6bbcd0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2396-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download