7fb76cbc560551518f1ed1c77b4e930b6faff77f63815f0090712eb644d87fe0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_0000053Legal_warning_Invoices.exe
Size 743KB
Sample240826-taaetstbpp
SHA256 7fb76cbc560551518f1ed1c77b4e930b6faff77f63815f0090712eb644d87fe0
MD5 70836ea62c86701beea228207ebbe690
SHA1 16aa45a1149f7ac44bfacf029d338a67e26501ff
SHA512 d7fefb5729b6ebcf66fd4339232d43bb7d430255e3bd73cfc0af5edd2030d7744d3ecd51ddc94710ebc18e29bbf30e0af79281d07ca7ee8e1bfb614cd11d1f28
SSDEEP 12288:9I0Ygl+4LU7HJx5q7vMw/hCIToWURuDnEF9jyY2eAuVLZEqhaH/e5ofi:9I0blDAdeIJVAg48AuVLZEkIfi
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2276	IMG_0000053Legal_warning_Invoices.exe
2276	IMG_0000053Legal_warning_Invoices.exe
2276	IMG_0000053Legal_warning_Invoices.exe
2276	IMG_0000053Legal_warning_Invoices.exe
2276	IMG_0000053Legal_warning_Invoices.exe
2276	IMG_0000053Legal_warning_Invoices.exe
2276	IMG_0000053Legal_warning_Invoices.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Eritas.fat	IMG_0000053Legal_warning_Invoices.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	2276	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMG_0000053Legal_warning_Invoices.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2552	2276	IMG_0000053Legal_warning_Invoices.exe	30
PID 2276 wrote to memory of 2552	2276	IMG_0000053Legal_warning_Invoices.exe	30
PID 2276 wrote to memory of 2552	2276	IMG_0000053Legal_warning_Invoices.exe	30
PID 2276 wrote to memory of 2552	2276	IMG_0000053Legal_warning_Invoices.exe	30

C:\Users\Admin\AppData\Local\Temp\IMG_0000053Legal_warning_Invoices.exe
"C:\Users\Admin\AppData\Local\Temp\IMG_0000053Legal_warning_Invoices.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 516
  2⤵
  - Program crash
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path \Users\Admin\AppData\Local\Temp\nstF98C.tmp\LangDLL.dll
Size 5KB
SHA256 982954ea90a10844bff23d595ac2449c6fae300aee2ab4c23077aac1197b7c2e
MD5 c5351b7c9aa48e9e7872288a3e7dd583
SHA1 69efcf341345625a4a855f03f2a9d9e8f50319b2
SHA512 6e655e02aa05bc52beec428686622c4c1c1ffc7e5aba0f6d429495cba29bee5733b26ac7aecbeaa9e525eae52706a2513035d17cc7b0ccbcf792c765c9427d7b
SSDEEP 48:SFPPhYdei1W0Moh82rI7+S2QWviyviU1qeePWfhfof3mkV:+BFi1e12rI7+TvpQeh
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nstF98C.tmp\System.dll
Size 11KB
SHA256 7e75f148920db6300dad5a1c12fd5d6eecc95698a310a01311181bc98a704d55
MD5 c61501f07cf09bcfcdfe4cc8a1ebbbe3
SHA1 e8581b4359651b857646ae727efaaef372daa0fc
SHA512 9837abe7ec3fa0f1f5193968d12b7ca1893e34eddf628db1f7ab6715b4de339231f0ec1b5f0f86c767f5a30c40da5c4a95e99deedd22eece93cb0d00539aad24
SSDEEP 192:Kk09rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:Kk0JQEaVAK7R9SfpjpQYLRszfH/d9CWv
MD5 SHA1 SHA512 SSDEEP