3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402

Analysis

max time kernel
94s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-0801_01.exe
Size 1.2MB
Sample240801-16r33stcla
SHA256 3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402
MD5 56dbc4367833434be158a1a0cebbd1a9
SHA1 9097801ea095f4b4afc15497d9370d3c8a5c913b
SHA512 c216c2ed433994fd1a7759a90dd3464d266014dd5efdc2da30f267ced8d393c17c9f93f425c27a4b76655a1abb34393f0b4fd9d7c8d4efca527c28ce99623a75
SSDEEP 24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8aBsjPz4CXMD:RTvC/MTQYxsWR7aBsjP
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4680 set thread context of 4404	4680	2024-0801_01.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	4680	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-0801_01.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe
4404	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4680	2024-0801_01.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4680	2024-0801_01.exe
4680	2024-0801_01.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4680	2024-0801_01.exe
4680	2024-0801_01.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4404	4680	2024-0801_01.exe	86
PID 4680 wrote to memory of 4404	4680	2024-0801_01.exe	86
PID 4680 wrote to memory of 4404	4680	2024-0801_01.exe	86
PID 4680 wrote to memory of 4404	4680	2024-0801_01.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-0801_01.exe
"C:\Users\Admin\AppData\Local\Temp\2024-0801_01.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-0801_01.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 728
  2⤵
  - Program crash
  PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4680 -ip 4680
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autBFF4.tmp

Path C:\Users\Admin\AppData\Local\Temp\autBFF4.tmp
Size 280KB
SHA256 9ac40f84820e94850d21aa67c374c765a6a0958f9d6397b2b0beef59aedeb6be
MD5 b6d48637d1736c2f8f616a9c6f7551a5
SHA1 0808f51721d3421dd2e82d6c6f493635faf65499
SHA512 d43d19b23bdcc3cffe7e4837c3b82ec3da2900356ac0339e1bb1002be77e62429e120da6b1f4f110feca1da863d6124ffd4d62675c316d09fabc8f4353ac0e86
SSDEEP 6144:OxmzXwZsgBHop+9VruuQ5IosPWG2KvpQ87LKqOusLXrq3jmsTo+b8T5V:NzgBIyiDI7OOQ87eqOJrqzzT5QX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4404-14-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4404-15-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4404-16-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4404-17-0x0000000001600000-0x000000000194A000-memory.dmp

Download

memory/4404-18-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4680-13-0x0000000000ED0000-0x0000000000ED4000-memory.dmp

Download