5ea01e1e35547ef6d43efe438a79cea64426da879fefb6a7724c610a266e185f

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

114f6a98e9df6d15b8766c21c6992940N.exe
Size

700KB
MD5

114f6a98e9df6d15b8766c21c6992940
SHA1

0870088d5a5ca7b41c57d77e91c8a4f9e1f0ec10
SHA256

5ea01e1e35547ef6d43efe438a79cea64426da879fefb6a7724c610a266e185f
SHA512

db403f0b82e0d24ef43d0f1ddd562c81095b920a25a8944421db818807b62b28efe9da574c4c6c9fd821185cd41ded92741bbc2b72b230cf55d949e39c85bb9c
SSDEEP

6144:5kgiPA6RcPlaAfbAfNtTAfMAfFAfNM3LCNOASASElaAfbAfNtTAfMAfFAfN:TiPGmNtuhUNM3+NdSAS4mNtuhUN

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	3168	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	114f6a98e9df6d15b8766c21c6992940N.exe

C:\Users\Admin\AppData\Local\Temp\114f6a98e9df6d15b8766c21c6992940N.exe
"C:\Users\Admin\AppData\Local\Temp\114f6a98e9df6d15b8766c21c6992940N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 216
  2⤵
  - Program crash
  PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3168 -ip 3168
1⤵
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3168-0-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3168-1-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download