Analysis
-
max time kernel
131s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-08-2024 09:33
General
-
Target
Número de pedido 4200184273.exe
-
Size
1.1MB
-
MD5
b16013adb22dc5bfbf451f39eb236c3a
-
SHA1
a631bec8b7c0b9cc7e15650696cfe2008e831293
-
SHA256
b1d0a89c8011e4cc83a8f5a85de92655fd7515bb816a15959505ce3c2c897871
-
SHA512
9e80d52969ebeeaa46860095d27ea76b7c1e04f9d21cbfb043fc91ba2f988e50fbe61c837ad18c6982d98176f226e6c700e8da9bdc1145ca5336a8e8ccbc4c13
-
SSDEEP
24576:fqDEvCTbMWu7rQYlBQcBiT6rprG8akTXQu21men:fTvC/MTQYxsWR7aKXQuMme
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Número de pedido 4200184273.exe"C:\Users\Admin\AppData\Local\Temp\Número de pedido 4200184273.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Número de pedido 4200184273.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 6682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3144 -ip 31441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB