5e322915c06b8a233e8b37c05be3e2df7ea0a6ed6629b708c4606bdb41beb14e

Analysis

max time kernel
110s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6116809acfac6247dd333b7ae37eece0N.exe
Size

4.5MB
MD5

6116809acfac6247dd333b7ae37eece0
SHA1

1afd901a233f96840d6b74c433865b946797eddc
SHA256

5e322915c06b8a233e8b37c05be3e2df7ea0a6ed6629b708c4606bdb41beb14e
SHA512

5dbf6e1dfab1d8bffb80568cdb7fa18dbdd6276895b587f6410dd124932dc4f9a965cc8464a673b528e1919109ea288374f2cf38b6904ebde3fb08939e2928ee
SSDEEP

98304:P9ldHPQj6QtL0Vwghfks7UtY3wcfGunyzHCd0sy+IhCxpDh:P9lxYDLRcfks7KYgclVpDh

Score

3^/10

discovery

Malware Config

Signatures

Program crash 11 IoCs

pid	pid_target	Process	procid_target
4660	2444	WerFault.exe	81
1492	2444	WerFault.exe	81
4908	2444	WerFault.exe	81
1780	2444	WerFault.exe	81
2220	2444	WerFault.exe	81
4804	2444	WerFault.exe	81
2688	2444	WerFault.exe	81
1504	2444	WerFault.exe	81
1316	2444	WerFault.exe	81
3272	2444	WerFault.exe	81
1212	2444	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6116809acfac6247dd333b7ae37eece0N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2444	6116809acfac6247dd333b7ae37eece0N.exe
2444	6116809acfac6247dd333b7ae37eece0N.exe

C:\Users\Admin\AppData\Local\Temp\6116809acfac6247dd333b7ae37eece0N.exe
"C:\Users\Admin\AppData\Local\Temp\6116809acfac6247dd333b7ae37eece0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 852
  2⤵
  - Program crash
  PID:4660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 860
  2⤵
  - Program crash
  PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 940
  2⤵
  - Program crash
  PID:4908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1060
  2⤵
  - Program crash
  PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1072
  2⤵
  - Program crash
  PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1072
  2⤵
  - Program crash
  PID:4804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1112
  2⤵
  - Program crash
  PID:2688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1208
  2⤵
  - Program crash
  PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1216
  2⤵
  - Program crash
  PID:1316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 968
  2⤵
  - Program crash
  PID:3272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 932
  2⤵
  - Program crash
  PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2444 -ip 2444
1⤵
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2444 -ip 2444
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2444 -ip 2444
1⤵
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2444 -ip 2444
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2444 -ip 2444
1⤵
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2444 -ip 2444
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2444 -ip 2444
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2444 -ip 2444
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2444 -ip 2444
1⤵
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2444 -ip 2444
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2444 -ip 2444
1⤵
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-0-0x0000000000400000-0x0000000000C8C000-memory.dmp

Filesize
8.5MB

Download
memory/2444-1-0x0000000000400000-0x0000000000C8C000-memory.dmp

Filesize
8.5MB

Download
memory/2444-2-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/2444-3-0x0000000000400000-0x0000000000C8C000-memory.dmp

Filesize
8.5MB

Download
memory/2444-4-0x0000000000400000-0x0000000000C8C000-memory.dmp

Filesize
8.5MB

Download
memory/2444-5-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/2444-7-0x0000000000400000-0x0000000000C8C000-memory.dmp

Filesize
8.5MB

Download
memory/2444-6-0x0000000000400000-0x0000000000C8C000-memory.dmp

Filesize
8.5MB

Download