1f955c5aacd3704bb19ab7e6bc79c56763e49ba6a383aa35c1dc6efa7f781872

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f955c5aacd3704bb19ab7e6bc79c56763e49ba6a383aa35c1dc6efa7f781872.exe
Size

472KB
MD5

8a867a85ba636c62f91faeab747a1109
SHA1

ffd78f79d8713ae6e2a9c2ed9445d795eb82c8e4
SHA256

1f955c5aacd3704bb19ab7e6bc79c56763e49ba6a383aa35c1dc6efa7f781872
SHA512

c3d68d2cca569946b85a7267c5a7c1a0e3972dca7034ce91b76bcd3e26f5573bf9bc60938e7370de8f095af1396b3ceb33a8bcef3b3d57ebb0e0e6ab5aff9508
SSDEEP

3072:oI8RinudiP52xx67lLdGiHDoWNHHOrmHpSKCTmz7:o9kgiPA6RUPWNOrmpNCTmH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	4140	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f955c5aacd3704bb19ab7e6bc79c56763e49ba6a383aa35c1dc6efa7f781872.exe

C:\Users\Admin\AppData\Local\Temp\1f955c5aacd3704bb19ab7e6bc79c56763e49ba6a383aa35c1dc6efa7f781872.exe
"C:\Users\Admin\AppData\Local\Temp\1f955c5aacd3704bb19ab7e6bc79c56763e49ba6a383aa35c1dc6efa7f781872.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 224
  2⤵
  - Program crash
  PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4140 -ip 4140
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4140-0-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download