78f3b882d5cfeaf9f20517fb9a7d7f9b1197a384a43ec7cd274a969ace9d149d

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27e7f0760becfcdaf97031bcf8010fb0N.exe
Size

8.2MB
MD5

27e7f0760becfcdaf97031bcf8010fb0
SHA1

fafbaa29b880ba62b3c3ce12eab185cd0cc56edd
SHA256

78f3b882d5cfeaf9f20517fb9a7d7f9b1197a384a43ec7cd274a969ace9d149d
SHA512

0d612048d51fbaa5f262b73647eeaba7355cbab047520b5806930ef98d0030426f3d1cbb1260182971a778bf2ca7149228a633287a03dca9b486f3e5cc388eb9
SSDEEP

98304:qXtWHdC/yvl5YBLjU8/cOT0MMHMMM6MMZMMMqo30MMHMMM6MMZMMMqaYMMHMMMvy:iuCQl5CXfQ1/z

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4292	27e7f0760becfcdaf97031bcf8010fb0N.exe

Executes dropped EXE 1 IoCs

pid	Process
4292	27e7f0760becfcdaf97031bcf8010fb0N.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2412	1196	WerFault.exe	83
4532	4292	WerFault.exe	91
3776	4292	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27e7f0760becfcdaf97031bcf8010fb0N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1196	27e7f0760becfcdaf97031bcf8010fb0N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4292	27e7f0760becfcdaf97031bcf8010fb0N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4292	1196	27e7f0760becfcdaf97031bcf8010fb0N.exe	91
PID 1196 wrote to memory of 4292	1196	27e7f0760becfcdaf97031bcf8010fb0N.exe	91
PID 1196 wrote to memory of 4292	1196	27e7f0760becfcdaf97031bcf8010fb0N.exe	91

C:\Users\Admin\AppData\Local\Temp\27e7f0760becfcdaf97031bcf8010fb0N.exe
"C:\Users\Admin\AppData\Local\Temp\27e7f0760becfcdaf97031bcf8010fb0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 344
  2⤵
  - Program crash
  PID:2412
- C:\Users\Admin\AppData\Local\Temp\27e7f0760becfcdaf97031bcf8010fb0N.exe
  C:\Users\Admin\AppData\Local\Temp\27e7f0760becfcdaf97031bcf8010fb0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 344
    3⤵
    - Program crash
    PID:4532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 344
    3⤵
    - Program crash
    PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1196 -ip 1196
1⤵
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4292 -ip 4292
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4292 -ip 4292
1⤵
PID:600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\27e7f0760becfcdaf97031bcf8010fb0N.exe

Filesize
8.2MB

MD5
71b36af20ae725bd99de545e0e5be5ee

SHA1
768d2370c9c825b2f907ebb2c94f640c72c257dd

SHA256
69f9455d533d5ee9d34f2c095ec971df68e884071aca97326cfa0c9549b6c877

SHA512
39d6e28fe4eb81201016588b8faac11960733706f325b19a23508e7eb9e743253ec555b789fe53808e04940b83a494d38d2c8099e380a82f4bb97095254dae36

Download Submit
memory/1196-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1196-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4292-8-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4292-9-0x0000000005120000-0x0000000005205000-memory.dmp

Filesize
916KB

Download
memory/4292-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download