fc708666be9cd952b23acaaa51c2ef9d920002d5b901d5213a430bc18db625bf

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2025, 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/ChromePortableTemp/7za.exe
Size

796KB
MD5

90aac6489f6b226bf7dc1adabfdb1259
SHA1

c90c47b717b776922cdd09758d2b4212d9ae4911
SHA256

ba7f3627715614d113c1e1cd7dd9d47e3402a1e8a7404043e08bc14939364549
SHA512

befaa9b27dc11e226b00a651aa91cbfe1ec36127084d87d44b6cd8a5076e0a092a162059295d3fcd17abb6ea9adb3b703f3652ae558c2eef4e8932131397c12d
SSDEEP

24576:HWdp+y7/ya3yc7tfBA6rDUzfKrBxEATB:up+fa3rLA6s+/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\ChromePortableTemp\7za.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\ChromePortableTemp\7za.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...