123e015d2cca29172525c587470b1a0e98f972824f93030b4d17684e7fe5f227

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Confirmation.docx.exe
Size

1.3MB
MD5

cc457c86d15ea18546d9065f5ca4ee04
SHA1

66192064544af9b72ffd054ed8bde5aad95576c6
SHA256

59640b32fd4e89cd138da35df35473a554da351660e7b654610642433135032c
SHA512

0580495ce9856d5094cddd439fa2d4063b5e78d0d1af926259c45c72bda3ec357243c537474b8c8c390a8fe500de19ce2b3271896c779dccd0ccf980357f909a
SSDEEP

24576:ypCC3MJPg7zsOTpKwM4LNPprrwr6HSJAXv0E65vYZv/UdW3seBdZwq:hbg/Nhrsr6HSJSME6VXWzBkq

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4892	4940	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Confirmation.docx.exe

Script User-Agent 9 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	40	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	46	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	30	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	44	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	48	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Users\Admin\AppData\Local\Temp\Confirmation.docx.exe
"C:\Users\Admin\AppData\Local\Temp\Confirmation.docx.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 1564
  2⤵
  - Program crash
  PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4940 -ip 4940
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4940-0-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4940-1-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-2-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-10-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-18-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-21-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-22-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-19-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-17-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-16-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-15-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-14-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-13-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-12-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-11-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-9-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-8-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-7-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-6-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-5-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-4-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-3-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-20-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-31-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-23-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-32-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-51-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-52-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-54-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-53-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-49-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-48-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-47-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-46-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-44-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-43-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-41-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-40-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-38-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-37-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-35-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-34-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-33-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-30-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-50-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-29-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-28-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-45-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-27-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-42-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-26-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-39-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-25-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-36-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-24-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-61-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-60-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-59-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-57-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-64-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-62-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-58-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-55-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4940-541-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download