d66577872ebf8ec7138102e46f35220fb823e502ece7a51b4989c961eb9549a3

Analysis

max time kernel
94s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TGN X/bin/268_kick_fixer.exe
Size

23KB
MD5

5d0ba9bae55a709061d5add0bf77cd38
SHA1

f8d0c250370f29376baf0d3ac20e743b8d61643a
SHA256

dc1650dc4ddc0e3bc4b068d2d3866d33453b8173a7a617c793b38baf201c62e6
SHA512

2e396febe2caf3a1669c697704611318d6e662493e5d361d85ee3056c237ff2c4d0e04acf7a26823e149ce227908e6c1980f7527ae6938ba1518eb78fafe25da
SSDEEP

384:NyeBVlKu09hDKCOyy3hKizN8ODb+MxspMJpjPvjtiYGeKjX:NdP+3UKO3QMfv5i1eU

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3568	1388	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	268_kick_fixer.exe

C:\Users\Admin\AppData\Local\Temp\TGN X\bin\268_kick_fixer.exe
"C:\Users\Admin\AppData\Local\Temp\TGN X\bin\268_kick_fixer.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 884
  2⤵
  - Program crash
  PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1388 -ip 1388
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-0-0x000000007511E000-0x000000007511F000-memory.dmp

Filesize
4KB

Download
memory/1388-1-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Filesize
48KB

Download