8726514326a0c9356290f04bab1c7ec2174e2a547bf25fb04ee866042352b709

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8726514326a0c9356290f04bab1c7ec2174e2a547bf25fb04ee866042352b709N.exe
Size

468KB
MD5

bc9d4da7e59a4606b882b58024d714d0
SHA1

e5e459618f26ab2a881661c36c7efdebf04c5bc6
SHA256

8726514326a0c9356290f04bab1c7ec2174e2a547bf25fb04ee866042352b709
SHA512

6bd1b8f529e441d7b51bac8fed55688ca60d9004948f9d5910a087b952f3edeaa9287586a97ffef2964aecd317d67d423da478aff3fe878d6416ea286fa4e6ac
SSDEEP

3072:tq9KowLNyq8o6bYBfzzj5f5/lgMosfBnmHe4VsUqSNXU24ZTClr:tqQolTo6Kf/j5f6+3SqSpv4ZT

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4844	1464	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8726514326a0c9356290f04bab1c7ec2174e2a547bf25fb04ee866042352b709N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1464	8726514326a0c9356290f04bab1c7ec2174e2a547bf25fb04ee866042352b709N.exe

C:\Users\Admin\AppData\Local\Temp\8726514326a0c9356290f04bab1c7ec2174e2a547bf25fb04ee866042352b709N.exe
"C:\Users\Admin\AppData\Local\Temp\8726514326a0c9356290f04bab1c7ec2174e2a547bf25fb04ee866042352b709N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 724
  2⤵
  - Program crash
  PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1464 -ip 1464
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1464-3-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download