2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183

Analysis

max time kernel
133s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe
Size

103KB
MD5

72df7fd0854935ba0b5e07f723589392
SHA1

d628cb84d232f83dcd291e43ff079fb481290a7d
SHA256

2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183
SHA512

12dfc847064842207c3b87119145fb50ebd647f9eb6ef997ad47c1f5e451f2f2033635169aed28a8f6288f718fbce56d8a67c2178dd26dc016de52bed2520e67
SSDEEP

3072:vomnzVincQDKgcp3bsOW+NMY7sDti0dP0L0nLn:vtZVsyNMYytiFL4j

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
840	2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	840	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3704	840	2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe	92
PID 840 wrote to memory of 3704	840	2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe	92
PID 840 wrote to memory of 3704	840	2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe	92

C:\Users\Admin\AppData\Local\Temp\2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe
"C:\Users\Admin\AppData\Local\Temp\2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe
  "C:\Users\Admin\AppData\Local\Temp\2aae8c4c79d6332be6f899936c662326250d402f13b1ef85f930d61d4179e183.exe"
  2⤵
  PID:3704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 948
  2⤵
  - Program crash
  PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 840 -ip 840
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsb976E.tmp\System.dll

Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\dsffffffdd.lnk

Filesize
1KB

MD5
9c5652b806c47f76ebf766c0ee324c54

SHA1
474424d859f6aebc4b030b8567f10697614a24c2

SHA256
f3394a0f352f950d56e591442d3862cc0808111c64aa70e6f7e9234a09e3b243

SHA512
f0ee4bc743a3979c7f99e4d83634bc6876502cb67e4903c643a75abe88d84872c6a2bafd15d1777c389d2d08ef81bf8032ad4580bd5e82aee58bba46f65d26e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zsadsadsad\qasdadsdsd.lnk

Filesize
1KB

MD5
eabc652fff8ed24d2c2ba7ed47569338

SHA1
41645a19c845c0476e33bb331f15533982116057

SHA256
238bb3e7e47dc508bf77e118a15233bbf43a0900b10f7b917d985f50839cad6e

SHA512
0ee67b5a53744569e770b4fa125a172f299077e5bbf273ee111c35863a3f2161f986d310747393d9df6bca5827c3f817def5f8d6feb3c6d4043c9f908b9c7ae7

Download Submit