69cfdd7648e85a9976063c76e042b07decb727b3b3744820584aa88c32b3b479

Analysis

max time kernel
35s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c0086f5428034dbd15db205b7416660N.exe
Size

2.8MB
MD5

4c0086f5428034dbd15db205b7416660
SHA1

cf1ba15313c06d0e15a8038dbd54072fdabc5109
SHA256

69cfdd7648e85a9976063c76e042b07decb727b3b3744820584aa88c32b3b479
SHA512

ae90b31aa2ccd3c2e6a99dbe4788b05ded980845c6abe0cfde9cf2ccc84a3616e1c48957a251068206cb430fe27cbba5dd238793b2012b4c38f129d16ba2b1fe
SSDEEP

24576:090ddKpX/wn1ta/ZSsniF+ujZXIMfX2av5SAODFDDaPZS6XSl+t:+sdAvwTgxniXtXIMfX2wGBDDQ/XSe

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2800	4c0086f5428034dbd15db205b7416660N.exe

Executes dropped EXE 1 IoCs

pid	Process
2800	4c0086f5428034dbd15db205b7416660N.exe

Loads dropped DLL 4 IoCs

pid	Process
2312	4c0086f5428034dbd15db205b7416660N.exe
2816	WerFault.exe
2816	WerFault.exe
2816	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	2800	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c0086f5428034dbd15db205b7416660N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c0086f5428034dbd15db205b7416660N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2312	4c0086f5428034dbd15db205b7416660N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2800	4c0086f5428034dbd15db205b7416660N.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2800	2312	4c0086f5428034dbd15db205b7416660N.exe	31
PID 2312 wrote to memory of 2800	2312	4c0086f5428034dbd15db205b7416660N.exe	31
PID 2312 wrote to memory of 2800	2312	4c0086f5428034dbd15db205b7416660N.exe	31
PID 2312 wrote to memory of 2800	2312	4c0086f5428034dbd15db205b7416660N.exe	31
PID 2800 wrote to memory of 2816	2800	4c0086f5428034dbd15db205b7416660N.exe	32
PID 2800 wrote to memory of 2816	2800	4c0086f5428034dbd15db205b7416660N.exe	32
PID 2800 wrote to memory of 2816	2800	4c0086f5428034dbd15db205b7416660N.exe	32
PID 2800 wrote to memory of 2816	2800	4c0086f5428034dbd15db205b7416660N.exe	32

C:\Users\Admin\AppData\Local\Temp\4c0086f5428034dbd15db205b7416660N.exe
"C:\Users\Admin\AppData\Local\Temp\4c0086f5428034dbd15db205b7416660N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\4c0086f5428034dbd15db205b7416660N.exe
  C:\Users\Admin\AppData\Local\Temp\4c0086f5428034dbd15db205b7416660N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 144
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\4c0086f5428034dbd15db205b7416660N.exe

Filesize
2.8MB

MD5
23cda49f850ed64295ef7fd8ce64a048

SHA1
96e8b0fc012605c1f63716fcd5b5ce64e653fd64

SHA256
61e247272702499cf456addfe0c590490681b2b085ff91690c23629f20b76e44

SHA512
f9a4c9857c12a33ef7f512b408679325fd5c2d9d419518249a0c7e5c07aa437e44f50a0bd3f14471ca8fdffd326be3815170c48d446cfaded5dfa72e6f0a7a7b

Download Submit
memory/2312-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2312-7-0x0000000000300000-0x00000000003E8000-memory.dmp

Filesize
928KB

Download
memory/2312-9-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2800-10-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2800-11-0x0000000002D10000-0x0000000002DF8000-memory.dmp

Filesize
928KB

Download