123e015d2cca29172525c587470b1a0e98f972824f93030b4d17684e7fe5f227

Analysis

max time kernel
290s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-09-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Confirmation.docx.exe
Size

1.3MB
MD5

cc457c86d15ea18546d9065f5ca4ee04
SHA1

66192064544af9b72ffd054ed8bde5aad95576c6
SHA256

59640b32fd4e89cd138da35df35473a554da351660e7b654610642433135032c
SHA512

0580495ce9856d5094cddd439fa2d4063b5e78d0d1af926259c45c72bda3ec357243c537474b8c8c390a8fe500de19ce2b3271896c779dccd0ccf980357f909a
SSDEEP

24576:ypCC3MJPg7zsOTpKwM4LNPprrwr6HSJAXv0E65vYZv/UdW3seBdZwq:hbg/Nhrsr6HSJSME6VXWzBkq

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3776	1728	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Confirmation.docx.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3776	1728	Confirmation.docx.exe	31
PID 1728 wrote to memory of 3776	1728	Confirmation.docx.exe	31
PID 1728 wrote to memory of 3776	1728	Confirmation.docx.exe	31
PID 1728 wrote to memory of 3776	1728	Confirmation.docx.exe	31

C:\Users\Admin\AppData\Local\Temp\Confirmation.docx.exe
"C:\Users\Admin\AppData\Local\Temp\Confirmation.docx.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 732
  2⤵
  - Program crash
  PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1728-1-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-2-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-3-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-4-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-6-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-5-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-10-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-9-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-8-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-7-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-12-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-14-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-16-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-18-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-19-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-21-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-22-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-23-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-20-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-17-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-15-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-13-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-11-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-36-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-33-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-38-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-31-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-49-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-57-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-25-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-26-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-30-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-35-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-34-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-54-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-64-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-62-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-61-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-60-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-59-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-58-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-55-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-53-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-52-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-51-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-50-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-48-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-47-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-46-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-45-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-44-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-43-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-42-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-41-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-40-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-39-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-37-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-32-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-29-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-28-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-27-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-24-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1728-541-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download