62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd

Analysis

max time kernel
138s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe
Size

827KB
MD5

e530ec12a5de0845d3c8675001c53451
SHA1

8c2199fe9ef8e852e9b01678b085ad6d33e3b949
SHA256

62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd
SHA512

8821d01340199ba81eecff1475322cfad31a270028e0cf91e87fb85a7391f91b31d7e5cc464b9127384407b0f80da409f7901b7941d59f457e4a7f09faebfeb2
SSDEEP

24576:KeQsZHFF05EM4dmv5Xf+hPEM4dmv5y53QA:EkFF05j425Xf+hPj42563QA

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4292	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Executes dropped EXE 1 IoCs

pid	Process
4292	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1872	3204	WerFault.exe	83
4084	4292	WerFault.exe	90
1588	4292	WerFault.exe	90
5044	4292	WerFault.exe	90
5096	4292	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3204	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4292	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4292	3204	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe	90
PID 3204 wrote to memory of 4292	3204	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe	90
PID 3204 wrote to memory of 4292	3204	62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe	90

C:\Users\Admin\AppData\Local\Temp\62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe
"C:\Users\Admin\AppData\Local\Temp\62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 384
  2⤵
  - Program crash
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe
  C:\Users\Admin\AppData\Local\Temp\62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 360
    3⤵
    - Program crash
    PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 772
    3⤵
    - Program crash
    PID:1588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 792
    3⤵
    - Program crash
    PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 812
    3⤵
    - Program crash
    PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3204 -ip 3204
1⤵
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4292 -ip 4292
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4292 -ip 4292
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4292 -ip 4292
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4292 -ip 4292
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\62a2f468dd1ad9b6c26c9f445bb4ef6d2c1c2a1c5dfd8c9b7850455a43979efd.exe

Filesize
827KB

MD5
29a04d8dd8f51d40312edb11411e4d3a

SHA1
865fc96033f2cdef88a1fc2491a00befba33608f

SHA256
d9815570d0038940708e3db4f832c99597b68d5da3d9ee8ed7820754badd87bb

SHA512
9b69a671e8a143701605c71efbd703d490d5011fd1769f7118e0c38f353db484d870469519465cb3a6dd297d1e0b94053b27889c35ef64c72fd511272f00cf74

Download Submit
memory/3204-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3204-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4292-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4292-8-0x00000000015F0000-0x000000000162C000-memory.dmp

Filesize
240KB

Download
memory/4292-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download