5a98da432ac4056a1843d19aa1c409f6cd56e5bf830c6fad8cd12f93f418095e

Analysis

max time kernel
0s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01-10-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

unins000.exe
Size

436KB
MD5

b2aebff3474de2fdb3be48ee268f2bec
SHA1

8feaa6c4509151ef28f48a9b3c09fee15eeccebe
SHA256

023ddfff2ddaaa3bce687e393457bd993a94eae81b76d67e9f50e14c024c0e96
SHA512

a59ac5bd5e6d17446486575422ed6e05b95a34e1187dcf14d613d7ce30508cd5a365c9e13e311905e7d8801e20cb83822c4bec67322d580e8195b5f3fc97f39e
SSDEEP

6144:5vRscHtVzjwIRFzJZ2p26+jFWXYnj9iT2ebvXmUcCqkmAO2rjXH7ycDd3:5vRs4OIm2hWX4U2ebvRUAr77/3

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	4364	WerFault.exe	77

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe

C:\Users\Admin\AppData\Local\Temp\unins000.exe
"C:\Users\Admin\AppData\Local\Temp\unins000.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 624
  2⤵
  - Program crash
  PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4364 -ip 4364
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads