db8e46466f65679f465514489bf849dc8632e27d3ea5b982ce710a91b030b307

Analysis

max time kernel
104s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bab13d411ab55ab70ba8319a9c548490N.exe
Size

472KB
MD5

bab13d411ab55ab70ba8319a9c548490
SHA1

916595c91985c1b0b58b84d0cb44c77692087ba8
SHA256

db8e46466f65679f465514489bf849dc8632e27d3ea5b982ce710a91b030b307
SHA512

dc2c2123420bf743ecf500fe23a091c7e5f468688f86d66748476b4864a615951b4be19c229f2d3bf6064f903f1a6c11466b05d1c528006476c39c6d05020c9c
SSDEEP

3072:d7n8RinudiP52xx67lLdFiHDoP7B7nwkWshvIDG6YGJ1fw:dokgiPA6RLPPlYQveGpafw

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4508	712	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bab13d411ab55ab70ba8319a9c548490N.exe

C:\Users\Admin\AppData\Local\Temp\bab13d411ab55ab70ba8319a9c548490N.exe
"C:\Users\Admin\AppData\Local\Temp\bab13d411ab55ab70ba8319a9c548490N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 224
  2⤵
  - Program crash
  PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 712 -ip 712
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/712-0-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download