53b482b277e07d2fb54a0b4778304bd193410f93ba65261ed338e6465464ec08

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53b482b277e07d2fb54a0b4778304bd193410f93ba65261ed338e6465464ec08N.exe
Size

364KB
MD5

648e5d662739dd064b1468c439b07030
SHA1

be10f41781a9ce1974c629f6ba6880acfdec1b43
SHA256

53b482b277e07d2fb54a0b4778304bd193410f93ba65261ed338e6465464ec08
SHA512

d3d2c2a35cb7ff13fc5549884d3ce68b60ba8f9d30ff7b36f6177c15444c1dab933ab720437bc45efeb8667b31e22e07ded6536bb2c3b9d3d71a38ee92ac6027
SSDEEP

1536:jzXF8CvrJ4PBhDP35t6hVlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:jh8k6DP3r6hVltOrWKDBr+yJb

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1720	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53b482b277e07d2fb54a0b4778304bd193410f93ba65261ed338e6465464ec08N.exe

C:\Users\Admin\AppData\Local\Temp\53b482b277e07d2fb54a0b4778304bd193410f93ba65261ed338e6465464ec08N.exe
"C:\Users\Admin\AppData\Local\Temp\53b482b277e07d2fb54a0b4778304bd193410f93ba65261ed338e6465464ec08N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 220
  2⤵
  - Program crash
  PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1720 -ip 1720
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1720-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download