German LCID Sandbox Gate

What It Does

A sandbox-evasion technique used by JScript droppers to restrict execution to German-speaking Windows systems. The script reads HKCU\Control Panel\International\Locale via WScript.Shell.RegRead, parses the hex LCID with parseInt(value, 16), and compares it against a hardcoded whitelist of German-language locale identifiers. If the victim's locale is not in the whitelist, the script calls WScript.Quit() and exits cleanly.

This is geo-targeting, not generic anti-sandbox — it specifically excludes non-German victims rather than detecting VMs or debuggers.

Detection / Fingerprint

• Registry read: HKCU\Control Panel\International\Locale
• parseInt(..., 16) call on the registry value
• Whitelist array containing German LCIDs: [1031, 3079, 5127, 4103, 2055]
• Exit path: WScript.Quit() when no match
• Often combined with JScript obfuscation (sequential variable reassignment or dictionary lookup)

German LCID Whitelist

Implementation Pattern

Observed in d3d22298: ^[/intel/analyses/d3d22298134d18033e55bc3581fa12d5cf30fe121d256e4044516e2bcdde4e23.html]

sdso=[1031,3079,5127,4103,2055];
var zrf=parseInt(acc.RegRead('HKEY_CURRENT_USER\\Control Panel\\International\\Locale')+'@ComputerName',16);
for(var i=0;i<sdso.length;++i){
    if(zrf==sdso[i]){zrf=true;break;}
}
if(zrf!==true) WScript.Quit();

Note: The +'@ComputerName' suffix in the original is an artefact of the obfuscation — parseInt('0407@ComputerName',16) evaluates to 1031 because parseInt stops at the first non-hex character.

Reproduce on Your Own VMs

Create a local .js file with:

var shell = WScript.CreateObject("WScript.Shell");
var locale = shell.RegRead("HKCU\\Control Panel\\International\\Locale");
var lcid = parseInt(locale, 16);
var whitelist = [1031, 3079, 5127, 4103, 2055];
var allowed = false;
for(var i=0;i<whitelist.length;i++){
    if(lcid === whitelist[i]){ allowed = true; break; }
}
if(!allowed){
    WScript.Echo("Locale " + lcid + " not German — exiting.");
    WScript.Quit();
}
WScript.Echo("German locale detected — proceeding.");

Run with cscript //nologo test.js. On non-German Windows, the script exits.

Defensive Countermeasures

• Registry monitoring: Alert on wscript.exe/cscript.exe reading HKCU\Control Panel\International\Locale — this is rarely legitimate.
• Script sandbox: Configure analysis sandboxes to report German locale (de-DE) for JScript droppers, or to flag locale gates for analyst review.
• EDR rules: Detect JScript processes that read registry and immediately terminate with no child processes.

Pages Where Observed

• unclassified-js-german-locale-dropper entity page — family overview
• d3d22298 — 84-variable sequential-reassignment JScript dropper with German LCID gate and HTTP PHP C2 ^[/intel/analyses/d3d22298134d18033e55bc3581fa12d5cf30fe121d256e4044516e2bcdde4e23.html]