Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-09-2024 17:15
General
-
Target
1d2ef2f210ce46d5592139a9692ee887edb5ab0c81b837da65bbb6559132bc75.exe
-
Size
14.8MB
-
MD5
3550f6a7253cfdb833a28d1fe26b977c
-
SHA1
469cae2cb7d705bf26b17d87d53ccf1419f82941
-
SHA256
1d2ef2f210ce46d5592139a9692ee887edb5ab0c81b837da65bbb6559132bc75
-
SHA512
63f9c7cace73cd61235dc9095ff3423298435165925cba6d509bf72e1cfaf5eeea18b9681b22672970326218d784ec718ad1a4acc3638a700cfa4772863d81b6
-
SSDEEP
393216:c//Lb1ivclz5Y020oPBvhyEQheX+1ktLuSiTL08sQ:UzbBx5Y02xPB5shAD6XRp
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d2ef2f210ce46d5592139a9692ee887edb5ab0c81b837da65bbb6559132bc75.exe"C:\Users\Admin\AppData\Local\Temp\1d2ef2f210ce46d5592139a9692ee887edb5ab0c81b837da65bbb6559132bc75.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 9682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4064 -ip 40641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
-
Filesize
14.5MB
-
Filesize
14.5MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
14.5MB
-
Filesize
14.5MB
-
Filesize
12KB
-
Filesize
14.5MB
-
Filesize
5.0MB