Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
09/08/2024, 09:09
General
- Target HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr.exe
- Size 650KB
- Sample240809-k4vs7ayepp
- SHA256 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr.exe"C:\Users\Admin\AppData\Local\Temp\HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 13842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4340 -ip 43401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4340-0-0x000000007464E000-0x000000007464F000-memory.dmp
memory/4340-1-0x0000000000C80000-0x0000000000D2A000-memory.dmp
memory/4340-2-0x0000000007A30000-0x0000000007AAC000-memory.dmp
memory/4340-3-0x000000000B260000-0x000000000B804000-memory.dmp
memory/4340-4-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/4340-5-0x000000000AE50000-0x000000000AEE2000-memory.dmp
memory/4340-6-0x0000000005710000-0x000000000571A000-memory.dmp
memory/4340-7-0x00000000058D0000-0x000000000596C000-memory.dmp
memory/4340-8-0x0000000005AC0000-0x0000000005ADA000-memory.dmp
memory/4340-9-0x0000000006440000-0x000000000644E000-memory.dmp
memory/4340-10-0x0000000006450000-0x0000000006466000-memory.dmp
memory/4340-11-0x0000000006A30000-0x0000000006A8A000-memory.dmp
memory/4340-12-0x0000000074640000-0x0000000074DF0000-memory.dmp