d3b47982dc74bc3984e515dcad6787014924f1e941b3ef71b7a83c39742a0979

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/12/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92.dll
Size

43KB
MD5

434b3d419af30403f6679f0578e9ed44
SHA1

089b875bca3e06156cdf0166896b2f1a9f64de58
SHA256

35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92
SHA512

5813f0b03db301595e533f65d0293b0488c5c27192b70f42f6f115e104eac63276571e1ceb7e2ae0214dc4f5aca2312fa03b8218c79de1045fc1661687b0f665
SSDEEP

768:LB8/jsvvTTnDDHB6N1XRMPWDY1cszRpC1EYQP8zMxNX1qy/MI4kJP2E4Ws4xKOpC:L6/jCDh6N1XYWDwzWxQkzMz1qUM3inaT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2708	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2708	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2708	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2708	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2708	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2708	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2708	2212	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...