Analysis
-
max time kernel
148s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12-08-2024 08:47
General
-
Target
HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr
-
Size
650KB
-
MD5
c779cc1fe825364c13ae5f33117eb5cd
-
SHA1
b279806541f457da98a8cc5c28d99a2c6847a865
-
SHA256
913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6
-
SHA512
67375326422871ed3e60d01cea86dc8d4d625749e76c32e1d84f416298a979637c1590a7d0c09ed082f16bc451f6e6db12fba01467c0ca115142b81a750038cc
-
SSDEEP
12288:1O/WtWzhKLwODOngkIcYVxytl2bs6AwrLbo31zAKfjR44JQ/i3KaDv:pahKxOng0tl2bs/wrIFEqJiE
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr"C:\Users\Admin\AppData\Local\Temp\HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr" /S1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 13882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3884 -ip 38841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
680KB
-
Filesize
496KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
104KB
-
Filesize
88KB
-
Filesize
56KB
-
Filesize
360KB
-
Filesize
7.7MB