80b0320d02c9ffdfa5ae29d29f29d3cbaeddf3e57c842ff49ea8a48ebea5c6fa

Analysis

max time kernel
93s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80b0320d02c9ffdfa5ae29d29f29d3cbaeddf3e57c842ff49ea8a48ebea5c6fa.exe
Size

2.2MB
MD5

39f8f0c1f058730d50b6598c1815b1cc
SHA1

2f4ddab85d37f74545cd45e42c9d80ec748ee762
SHA256

80b0320d02c9ffdfa5ae29d29f29d3cbaeddf3e57c842ff49ea8a48ebea5c6fa
SHA512

30a79f045385e491bb8a18f984d986f17dbc2bd62cb216d6d58e0e245acc0bafa03282a5b37cfdc7836a94ad48abff7bd4f19c45f8f6f3989f4dff3ad90463d7
SSDEEP

24576:5ttQsuJZmSglrM4MToVZY+XmHFDhAq6OLFA+yfuQ5/3132w:5tWsumllnjXCd2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80b0320d02c9ffdfa5ae29d29f29d3cbaeddf3e57c842ff49ea8a48ebea5c6fa.exe

C:\Users\Admin\AppData\Local\Temp\80b0320d02c9ffdfa5ae29d29f29d3cbaeddf3e57c842ff49ea8a48ebea5c6fa.exe
"C:\Users\Admin\AppData\Local\Temp\80b0320d02c9ffdfa5ae29d29f29d3cbaeddf3e57c842ff49ea8a48ebea5c6fa.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2160-0-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download