f52b3e825a0b55cf3adc91401d5d93749c130c9ea94879245928a46ed39d5b8b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-03_67c20937f8403e3a2b8f8b0af8e4741f_virlock.exe
Size

109KB
MD5

67c20937f8403e3a2b8f8b0af8e4741f
SHA1

95abb1ba3bb18bee2cd32973f1e833f3e32dd14c
SHA256

f52b3e825a0b55cf3adc91401d5d93749c130c9ea94879245928a46ed39d5b8b
SHA512

3214e65c96d855c2b2be6877b60884fbe97871dc59cd97ec2891fe0cba6c968dbd5b762d539c27594257aa8823434e1c9cf0c808ab975fb229d1a1a39623f7ad
SSDEEP

1536:900A4amTK8e5+AsvQFFt46fEnsF1P5vcW/ai3PMxgBfYowOBmE:900A4al8Fvu4VsP5vjXkxghY6Bb

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2824	2724	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-03_67c20937f8403e3a2b8f8b0af8e4741f_virlock.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2824	2724	2024-09-03_67c20937f8403e3a2b8f8b0af8e4741f_virlock.exe	30
PID 2724 wrote to memory of 2824	2724	2024-09-03_67c20937f8403e3a2b8f8b0af8e4741f_virlock.exe	30
PID 2724 wrote to memory of 2824	2724	2024-09-03_67c20937f8403e3a2b8f8b0af8e4741f_virlock.exe	30
PID 2724 wrote to memory of 2824	2724	2024-09-03_67c20937f8403e3a2b8f8b0af8e4741f_virlock.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-03_67c20937f8403e3a2b8f8b0af8e4741f_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-03_67c20937f8403e3a2b8f8b0af8e4741f_virlock.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 36
  2⤵
  - Program crash
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2724-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download