20cb81dee086f39aca1b60dcf082297b77ceae9979478d056da7324db9215f2a

Analysis

max time kernel
135s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/FirefoxHandler.dll
Size

42KB
MD5

89299f2e807a795737d82926b076e570
SHA1

ab503dd7ac9028d35a45113fad14ca35b2b0ebd1
SHA256

68b2c80193a1b96c02bd6cf8b30210ed8d8c185855fe99b06ee6d70257e1e58a
SHA512

e8e7bda3f04657e7f36bef52d9d4309d45bb958f5829479ce3f36d39982d9122f9e770c5870301f7e1dc6596d842ed7a2e926a8a77639b213c5ed6e566cb4ecd
SSDEEP

768:g92TwvrKHG8lvQdxk/+IX19elUSrMQLisawIUqoULdAOfK+2+ZIG6DepE3:82kvkyxkWIF9elU1+ALWOfZZE0E3

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3532	1028	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1028	rundll32.exe
1028	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1028	2924	rundll32.exe	84
PID 2924 wrote to memory of 1028	2924	rundll32.exe	84
PID 2924 wrote to memory of 1028	2924	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 620
    3⤵
    - Program crash
    PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1028 -ip 1028
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads