16c09091e2b8afeacb24b864d1b3e1123c10dd062fc31ee955377d74242f8d88

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16c09091e2b8afeacb24b864d1b3e1123c10dd062fc31ee955377d74242f8d88N.exe
Size

32KB
MD5

a364e788625e7904339e10e3a48a8fe0
SHA1

10366c968f398ac5f5c232cd6ff709d4a87e7cb9
SHA256

16c09091e2b8afeacb24b864d1b3e1123c10dd062fc31ee955377d74242f8d88
SHA512

3b3327c47c14225f9a447edd91f679981bb025676e64c25f993a5ee6d26aef65b1e1f3dadd57d35a9d311f3bc4a609dee8ca03a99fbb9394078fd8211a601e84
SSDEEP

384:JMHuCj2V5Xy5i//6opQhX5Ao/qXeXy+vdtSK99kfxoLFNW+gLCSw0cAgpMc48t6v:JGuCm5iKPul5nvyUddwfSzFrVFnM

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4824	4268	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16c09091e2b8afeacb24b864d1b3e1123c10dd062fc31ee955377d74242f8d88N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4268	16c09091e2b8afeacb24b864d1b3e1123c10dd062fc31ee955377d74242f8d88N.exe
4268	16c09091e2b8afeacb24b864d1b3e1123c10dd062fc31ee955377d74242f8d88N.exe

C:\Users\Admin\AppData\Local\Temp\16c09091e2b8afeacb24b864d1b3e1123c10dd062fc31ee955377d74242f8d88N.exe
"C:\Users\Admin\AppData\Local\Temp\16c09091e2b8afeacb24b864d1b3e1123c10dd062fc31ee955377d74242f8d88N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 324
  2⤵
  - Program crash
  PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4268 -ip 4268
1⤵
PID:680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4268-0-0x00000000000D0000-0x00000000000D6000-memory.dmp

Filesize
24KB

Download
memory/4268-2-0x00000000000D0000-0x00000000000D6000-memory.dmp

Filesize
24KB

Download
memory/4268-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download