ab856110acc7c6a8e56be426b6d8642986beaab94838de11e40aac830ab834af

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab856110acc7c6a8e56be426b6d8642986beaab94838de11e40aac830ab834af.exe
Size

472KB
MD5

4eaa9eace541e1d471f07c04336d8737
SHA1

207990c4a3b547575205192d1c9a9510df013fbd
SHA256

ab856110acc7c6a8e56be426b6d8642986beaab94838de11e40aac830ab834af
SHA512

0ace6b118b58ade94d92289e3c9cf97cabca4511dd2ca5f1885358f7674823916a30fa469cbb727dfb300ec51ffe5216d9c9adf04a6b2b310f12ffb4a4513bdc
SSDEEP

3072:WB8RinudiP52xx67lLd/iHDo1Vp9IWVruIrNUjVWg6KI:WukgiPA6RBP1Vp9xrNgt6KI

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1888	4008	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab856110acc7c6a8e56be426b6d8642986beaab94838de11e40aac830ab834af.exe

C:\Users\Admin\AppData\Local\Temp\ab856110acc7c6a8e56be426b6d8642986beaab94838de11e40aac830ab834af.exe
"C:\Users\Admin\AppData\Local\Temp\ab856110acc7c6a8e56be426b6d8642986beaab94838de11e40aac830ab834af.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 224
  2⤵
  - Program crash
  PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4008 -ip 4008
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4008-0-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download