c6b71056cf5a7a0d3c29f6c1902a23383be6b0503cd63192801e8218c21b2b5f

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6b71056cf5a7a0d3c29f6c1902a23383be6b0503cd63192801e8218c21b2b5fN.exe
Size

468KB
MD5

64ffa88d01c8bd8e602220bf25a73f70
SHA1

c1113ddb3bcda1c9df657dcc2e7bedb09d67d815
SHA256

c6b71056cf5a7a0d3c29f6c1902a23383be6b0503cd63192801e8218c21b2b5f
SHA512

9607425e003e7b238a63ee0b4ad421c48fdadeaa9793be6b8c54d0b3433686c7caf1e866bfe7e0e82e04bd0d34a22938b7ab80bcdd3f1ddd617a85e4697bb584
SSDEEP

3072:thoXow3dji8U6mYCfz52ff5EChj+IponmHdaV4t2Is36BB4m7lL:thUo8bU62f12ffU0hl2Ii6B4m

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4264	3128	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6b71056cf5a7a0d3c29f6c1902a23383be6b0503cd63192801e8218c21b2b5fN.exe

C:\Users\Admin\AppData\Local\Temp\c6b71056cf5a7a0d3c29f6c1902a23383be6b0503cd63192801e8218c21b2b5fN.exe
"C:\Users\Admin\AppData\Local\Temp\c6b71056cf5a7a0d3c29f6c1902a23383be6b0503cd63192801e8218c21b2b5fN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 252
  2⤵
  - Program crash
  PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3128 -ip 3128
1⤵
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3128-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3128-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download