d220ff1fe1be45772d43e0be0ee4cc7cd9e282f6dad4ea84611fb099bba2475d

Analysis

max time kernel
95s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2024, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2404-31-0x0000000000400000-0x00000000004A2000-memory.exe
Size

648KB
MD5

af4478f0212a65d3654829bb85f14020
SHA1

53be437ae911aa5b12b7c1c303b81080cea054e7
SHA256

d220ff1fe1be45772d43e0be0ee4cc7cd9e282f6dad4ea84611fb099bba2475d
SHA512

4e182aeca930618a655175f20ab7f9ac236c69144c9eff55a0ab99328017d9aecd60c23df3132a8bf20383f8e2ce1b8d4bbf2ba8bd5e3f0cb32ba12deaa42a81
SSDEEP

1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/Eq3Izmd:nSHIG6mQwGmfOQd8YhY0/EuUG

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3300	1088	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2404-31-0x0000000000400000-0x00000000004A2000-memory.exe

C:\Users\Admin\AppData\Local\Temp\2404-31-0x0000000000400000-0x00000000004A2000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2404-31-0x0000000000400000-0x00000000004A2000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 216
  2⤵
  - Program crash
  PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1088 -ip 1088
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...