1cf620b5f6a51170f40e8ecf35dfc70b643a170140a3f87c0a79fb946d6ace96

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cf620b5f6a51170f40e8ecf35dfc70b643a170140a3f87c0a79fb946d6ace96.exe
Size

205KB
MD5

f4b030d8f06fcdeab6dbc5a8d90ea949
SHA1

c433438398b9dc5644dc5244255b592098069d8e
SHA256

1cf620b5f6a51170f40e8ecf35dfc70b643a170140a3f87c0a79fb946d6ace96
SHA512

7de46b5fa25dac43206df4b468cb3773828e46d3c38945d0eae49735812ac8e4974d53093f59333cd7f4d689887bf105df0a53d0c76a80b131a77b0137de2702
SSDEEP

3072:0IXqry+d3DxQcv7zhWPk65Ui8BhmqjNj8DCUNUO42YwHdKpUUzE0mu87Gw:dQCcv7Mk6bgL5jMCeU3dRCUI0mu8

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4164	1cf620b5f6a51170f40e8ecf35dfc70b643a170140a3f87c0a79fb946d6ace96.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sshnas21.dll	1cf620b5f6a51170f40e8ecf35dfc70b643a170140a3f87c0a79fb946d6ace96.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	4164	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1cf620b5f6a51170f40e8ecf35dfc70b643a170140a3f87c0a79fb946d6ace96.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4164	1cf620b5f6a51170f40e8ecf35dfc70b643a170140a3f87c0a79fb946d6ace96.exe

C:\Users\Admin\AppData\Local\Temp\1cf620b5f6a51170f40e8ecf35dfc70b643a170140a3f87c0a79fb946d6ace96.exe
"C:\Users\Admin\AppData\Local\Temp\1cf620b5f6a51170f40e8ecf35dfc70b643a170140a3f87c0a79fb946d6ace96.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 716
  2⤵
  - Program crash
  PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4164 -ip 4164
1⤵
PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sshnas21.dll

Filesize
168KB

MD5
b503f151c4fe95f2f2ffcaf97f746dd1

SHA1
523db101958241c31c2ef9c6b069724984878852

SHA256
b4e71f48a336443a64ba38079714b607072e10f81365793b5d710ed65cb44564

SHA512
ee0abce32c2d1a08eec76e0b0c44f358881e08576802e65df3252c6008a24791ba9acf2af9d3ccf9b74482c575afbdcf5510ee4860597d01e5f4fc841b00e489

Download Submit
memory/4164-1-0x0000000002120000-0x0000000002145000-memory.dmp

Filesize
148KB

Download
memory/4164-2-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/4164-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4164-10-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download