5d7b88bf27b17762ed012db8c76b3fd11c041c4a2e390fcdcf3685b799eba405

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88a50afab72d60c411da3ea09ac6da00N.exe
Size

915KB
MD5

88a50afab72d60c411da3ea09ac6da00
SHA1

bafb0bd75a1db159ed4294def4409a5cb527830f
SHA256

5d7b88bf27b17762ed012db8c76b3fd11c041c4a2e390fcdcf3685b799eba405
SHA512

a09a91eb6895ceaa69a9456a7f8f25a48aef196d8ffd026153776e532ce8274152e3dedf3932e70d6dc76f87a6b44997f4b431a59d49c610d7669150e1340b4a
SSDEEP

12288:fNnqni3ZP7MNT7mh3Cft3oVjjVDa/ZSF1q261:fNqni3ZDMJ0Sft36a/ZSF1q261

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2108	88a50afab72d60c411da3ea09ac6da00N.exe

Executes dropped EXE 1 IoCs

pid	Process
2108	88a50afab72d60c411da3ea09ac6da00N.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3588	3856	WerFault.exe	83
748	2108	WerFault.exe	91
2960	2108	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88a50afab72d60c411da3ea09ac6da00N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3856	88a50afab72d60c411da3ea09ac6da00N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2108	88a50afab72d60c411da3ea09ac6da00N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 2108	3856	88a50afab72d60c411da3ea09ac6da00N.exe	91
PID 3856 wrote to memory of 2108	3856	88a50afab72d60c411da3ea09ac6da00N.exe	91
PID 3856 wrote to memory of 2108	3856	88a50afab72d60c411da3ea09ac6da00N.exe	91

C:\Users\Admin\AppData\Local\Temp\88a50afab72d60c411da3ea09ac6da00N.exe
"C:\Users\Admin\AppData\Local\Temp\88a50afab72d60c411da3ea09ac6da00N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 344
  2⤵
  - Program crash
  PID:3588
- C:\Users\Admin\AppData\Local\Temp\88a50afab72d60c411da3ea09ac6da00N.exe
  C:\Users\Admin\AppData\Local\Temp\88a50afab72d60c411da3ea09ac6da00N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 344
    3⤵
    - Program crash
    PID:748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 368
    3⤵
    - Program crash
    PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3856 -ip 3856
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2108 -ip 2108
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2108 -ip 2108
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\88a50afab72d60c411da3ea09ac6da00N.exe

Filesize
915KB

MD5
e938a36150b1615b14d477c8e1f98738

SHA1
b642f1bc5befe178cb6ade0031f4f6fd42db311d

SHA256
eb6ee96e394ae3af8704eab2f7d6aa3ef928416f0cb898c96caf46085cace53c

SHA512
e07c647da3a60039b9f54d36c3cafcd11c9409cd3ac351504858cc80c92d35b0616e55bf38beea49ad32968f00dbad32a152b540492d4483d6e0afacc61791fe

Download Submit
memory/2108-7-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2108-8-0x0000000001670000-0x0000000001762000-memory.dmp

Filesize
968KB

Download
memory/2108-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3856-0-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/3856-6-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download