a3f0ccbf08359d063c5f998f9fca080c62ced93a02eaf1f31cb9e880780c4015

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6fc987e60cb5c195f8a038d6ed17798b6f352ccec5ca6ea52493bf81861f741a.exe
Size

184KB
MD5

6782eb999b700a1cdcf69ac98b4eceb0
SHA1

ac55455eeadc47270470a60ea69ff3233d6fbda0
SHA256

6fc987e60cb5c195f8a038d6ed17798b6f352ccec5ca6ea52493bf81861f741a
SHA512

d5aa8cde7aee5ab2d8a9931eb32c34d183f033192004370e8fa62bd733b3fc5dd6c4ce33b3fdde1128501feed1af0c93e83c2cc63e3669f4e8242f6bcdeeb21c
SSDEEP

3072:ji8toTo5VJAe10j2PdxyY8Fy16IpOKuIvDBxCePapil+vyFA:jiWoQme1nPjyY8yfq1il+vyF

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	60	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fc987e60cb5c195f8a038d6ed17798b6f352ccec5ca6ea52493bf81861f741a.exe

C:\Users\Admin\AppData\Local\Temp\6fc987e60cb5c195f8a038d6ed17798b6f352ccec5ca6ea52493bf81861f741a.exe
"C:\Users\Admin\AppData\Local\Temp\6fc987e60cb5c195f8a038d6ed17798b6f352ccec5ca6ea52493bf81861f741a.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:60
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 212
  2⤵
  - Program crash
  PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 60 -ip 60
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads