2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183

Analysis

max time kernel
130s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe
Size

103KB
MD5

72df7fd0854935ba0b5e07f723589392
SHA1

d628cb84d232f83dcd291e43ff079fb481290a7d
SHA256

2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183
SHA512

12dfc847064842207c3b87119145fb50ebd647f9eb6ef997ad47c1f5e451f2f2033635169aed28a8f6288f718fbce56d8a67c2178dd26dc016de52bed2520e67
SSDEEP

3072:vomnzVincQDKgcp3bsOW+NMY7sDti0dP0L0nLn:vtZVsyNMYytiFL4j

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
516	2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	516	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 708	516	2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe	88
PID 516 wrote to memory of 708	516	2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe	88
PID 516 wrote to memory of 708	516	2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe	88

C:\Users\Admin\AppData\Local\Temp\2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe
"C:\Users\Admin\AppData\Local\Temp\2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:516
- C:\Users\Admin\AppData\Local\Temp\2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe
  "C:\Users\Admin\AppData\Local\Temp\2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe"
  2⤵
  PID:708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 948
  2⤵
  - Program crash
  PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 516 -ip 516
1⤵
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy831B.tmp\System.dll

Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\dsffffffdd.lnk

Filesize
1KB

MD5
11e6899ba527759554ea4e7e8939e582

SHA1
b08511c727ecfc65c050673b0837dd7102c1723a

SHA256
a50c677788dbacf1e3146b57c6e53553cbf9b1555b56ab590f8a0c23245af3e2

SHA512
1940ccb2af7e494e46b49e5290117a27adb21b587e745ae15f3ccb0294f513423be9f5130bb000795e75a81f405a94f991ba9024fa29dc4d5bddf1c64a565dfa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\qasdadsdsd.lnk

Filesize
1KB

MD5
de6d4e504519987ef918d81d84a36aeb

SHA1
dc5ca2b850181551cbfc6749ef72d0b70f7a134f

SHA256
ad3f17c87b7ec2c43751f3b01e757476af5b43e25b2d51343d69a8085c2fa57d

SHA512
e7ea9232f1dc7cc0b6ac9d490f49d9065cbecdd9146cbf9b0c8b1ae6f3745869b60f4af90cecd09665d7d922599698c41c0b525de4497024493a88f32b56137b

Download Submit