037fc4097f0bff5853e03604235297d5dd142ca21ecc87683d97b0f0048982c2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

037fc4097f0bff5853e03604235297d5dd142ca21ecc87683d97b0f0048982c2N.exe
Size

72KB
MD5

e012ab033dc47c94cc8b400a636cf810
SHA1

614c7d72840bd8b37e3ac38c379de1c56dc3aa53
SHA256

037fc4097f0bff5853e03604235297d5dd142ca21ecc87683d97b0f0048982c2
SHA512

e1ffc13b1a8a9ca5ce28c4bd1782ce43ed3b5ed9db2b70460d7c4c0ea8b8b9d60d85bf49a05a282f345fdc751561a760f1290c2488bf04a839b601e0bed92a93
SSDEEP

768:ZpQNwC3BESe4Vqth+0V5vKUE3BEJwRr7y:DeT7BVwxfvrguK7y

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	2536	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	037fc4097f0bff5853e03604235297d5dd142ca21ecc87683d97b0f0048982c2N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2072	2536	037fc4097f0bff5853e03604235297d5dd142ca21ecc87683d97b0f0048982c2N.exe	31
PID 2536 wrote to memory of 2072	2536	037fc4097f0bff5853e03604235297d5dd142ca21ecc87683d97b0f0048982c2N.exe	31
PID 2536 wrote to memory of 2072	2536	037fc4097f0bff5853e03604235297d5dd142ca21ecc87683d97b0f0048982c2N.exe	31
PID 2536 wrote to memory of 2072	2536	037fc4097f0bff5853e03604235297d5dd142ca21ecc87683d97b0f0048982c2N.exe	31

C:\Users\Admin\AppData\Local\Temp\037fc4097f0bff5853e03604235297d5dd142ca21ecc87683d97b0f0048982c2N.exe
"C:\Users\Admin\AppData\Local\Temp\037fc4097f0bff5853e03604235297d5dd142ca21ecc87683d97b0f0048982c2N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 36
  2⤵
  - Program crash
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads