532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a

Resubmissions

17/04/2025, 16:16

250417-tqz1eswqy210

17/04/2025, 15:56

17/04/2025, 14:27

22/01/2023, 15:20

18/01/2022, 00:18

Analysis

max time kernel
72s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2025, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
Size 858KB
Sample250417-rssysazry6
SHA256 532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a
MD5 d305c0176dc9a1f3daf516e6034f2b57
SHA1 87faa41997ee2187247d117081d46284193fabda
SHA512 8f7ca5e48f4f21d8429d0719caa6dd705d74c466392c1e91d372915aa8e4855789cd288d94567a59d301cc7335e55c8e0836b3280199ee9001149ab6b36a0a8e
SSDEEP 12288:Ny+NVoWV7AfkAyQ1Jnox/EDA5v1OmlDNb52OAGiuTP/4vj6e3RhqfR7h9FYyLRmU:kOVFuAQ1Box/aeNNNb5pD/CjFmfROfq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe

Runs regedit.exe 1 IoCs

pid	Process
3164	regedit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3164	regedit.exe

C:\Users\Admin\AppData\Local\Temp\532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe
"C:\Users\Admin\AppData\Local\Temp\532bc078a68683ce70cb765191a128fadee2a23180b1a8e8a16b72f1a8ee291a.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5228

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads