30f3de8ad08c5925fb15c1472b3e2154947c54ff21374bf93d84d1a7f8a220c3

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30f3de8ad08c5925fb15c1472b3e2154947c54ff21374bf93d84d1a7f8a220c3N.exe
Size

121KB
MD5

feee8af784dcaef433a381fb3ecb6440
SHA1

eff45a0ed5d3b3d0c3fcfa65c9b8bec5072d82e7
SHA256

30f3de8ad08c5925fb15c1472b3e2154947c54ff21374bf93d84d1a7f8a220c3
SHA512

9377cb4c72c47ca2be5b463f3dfa01cd3ba88df1420724084f966083b01154522d0aea23bc181e23a484c988e3f90f42365bbb4d55062cf9e5946f4141bbd14d
SSDEEP

3072:ixKj90l2Mnp9JUq+xwk3pQ4+ezGRYopw82X0l8D4Yov2:ixrUwkWxeojw8404cv2

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2972-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral2/memory/2972-3-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3872	2972	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30f3de8ad08c5925fb15c1472b3e2154947c54ff21374bf93d84d1a7f8a220c3N.exe

C:\Users\Admin\AppData\Local\Temp\30f3de8ad08c5925fb15c1472b3e2154947c54ff21374bf93d84d1a7f8a220c3N.exe
"C:\Users\Admin\AppData\Local\Temp\30f3de8ad08c5925fb15c1472b3e2154947c54ff21374bf93d84d1a7f8a220c3N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 772
  2⤵
  - Program crash
  PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2972 -ip 2972
1⤵
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2972-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2972-2-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2972-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2972-6-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2972-10-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download