
Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021)

Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
System Location Discovery
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1614  external_id: T1614     source_name: FBI Ragnar Locker 2020  description: FBI. (2020, November 19). Indicators of Compromise Associated with Ragnar Locker Ransomware. Retrieved April 1, 2021.  url: https://assets.documentcloud.org/documents/20413525/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc.pdf     source_name: Sophos Geolocation 2016  description: Wisniewski, C. (2016, May 3). Location-based threats: How cybercriminals target you based on where you live. Retrieved April 1, 2021.  url: https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/     source_name: Bleepingcomputer RAT malware 2020  description: Abrams, L. (2020, October 23). New RAT malware gets commands via Discord, has ransomware feature. Retrieved April 1, 2021.  url: https://www.bleepingcomputer.com/news/security/new-rat-malware-gets-commands-via-discord-has-ransomware-feature/     source_name: AWS Instance Identity Documents  description: Amazon. (n.d.). Instance identity documents. Retrieved April 2, 2021.  url: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html     source_name: Microsoft Azure Instance Metadata 2021  description: Microsoft. (2021, February 21). Azure Instance Metadata Service (Windows). Retrieved April 2, 2021.  url: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service?tabs=windows     source_name: Securelist Trasparent Tribe 2020  description: Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved April 1, 2021.  url: https://securelist.com/transparent-tribe-part-1/98127/     