2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_______ ____ __(___ ________ _________).exe
Size

103KB
MD5

72df7fd0854935ba0b5e07f723589392
SHA1

d628cb84d232f83dcd291e43ff079fb481290a7d
SHA256

2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183
SHA512

12dfc847064842207c3b87119145fb50ebd647f9eb6ef997ad47c1f5e451f2f2033635169aed28a8f6288f718fbce56d8a67c2178dd26dc016de52bed2520e67
SSDEEP

3072:vomnzVincQDKgcp3bsOW+NMY7sDti0dP0L0nLn:vtZVsyNMYytiFL4j

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

_______ ____ __(___ ________ _________).exe

pid process

2600 _______ ____ __(___ ________ _________).exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2032 2600 WerFault.exe _______ ____ __(___ ________ _________).exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

_______ ____ __(___ ________ _________).exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _______ ____ __(___ ________ _________).exe

pid	process
2600	_______ ____ __(___ ________ _________).exe

pid	pid_target	process	target process
2032	2600	WerFault.exe	_______ ____ __(___ ________ _________).exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_______ ____ __(___ ________ _________).exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

_______ ____ __(___ ________ _________).exe

description	pid	process	target process
PID 2600 wrote to memory of 868	2600	_______ ____ __(___ ________ _________).exe	_______ ____ __(___ ________ _________).exe
PID 2600 wrote to memory of 868	2600	_______ ____ __(___ ________ _________).exe	_______ ____ __(___ ________ _________).exe
PID 2600 wrote to memory of 868	2600	_______ ____ __(___ ________ _________).exe	_______ ____ __(___ ________ _________).exe

C:\Users\Admin\AppData\Local\Temp\_______ ____ __(___ ________ _________).exe
"C:\Users\Admin\AppData\Local\Temp\_______ ____ __(___ ________ _________).exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\_______ ____ __(___ ________ _________).exe
  "C:\Users\Admin\AppData\Local\Temp\_______ ____ __(___ ________ _________).exe"
  2⤵
  PID:868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 948
  2⤵
  - Program crash
  PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2600 -ip 2600
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu8435.tmp\System.dll

Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\dsffffffdd.lnk

Filesize
1KB

MD5
ae69eb59bb717536a9bb8ae3cad75daa

SHA1
c893658b0c68205d14031bfbf14e5bb2ba4155e2

SHA256
5a6d59293ae6787999e4feaa1f8b2c0e471e0ad1ef934091b2ad6a24bbfd2e75

SHA512
087ce7394de936c404d54d34fbaaaae542062b704c6e3f00ba9599b1851b3f2392a8f7a6fbcb6d6e410f8516ff3a857b57f020c3490054205680bd22dba15586

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\qasdadsdsd.lnk

Filesize
1KB

MD5
9c324ebd9517a891e50d73e0af00e187

SHA1
f7fae63832a6312e1084a4b1fc6ba40a3e333faa

SHA256
f3068afb4dca560c4b9d2a622bcc8b4d24e090cdfa46e2f48a37df606d9b4807

SHA512
dcb1385ee7cd7e4eecb114c628d60ecbf8b3ecd20dc94311d9796d0a8743222681a75807f8d21bee47118c657ebd01754f208663379c021aec913d75a66e634f

Download Submit