7a6c2787558600aca9a836e83593072fe54f9981b31792b9ea9e1c9f02492459

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jpdesk.exe
Size

903KB
MD5

fd11f6fe68c6a543576fd06e9258b359
SHA1

df92e8b8f6e1e16f00667387f249c1f6b9cc8892
SHA256

a5e2d6c7db54bc2e15ff5b7bd0f0bf4c416b842fdd2a609e5d85b67b9650c686
SHA512

4480373c91cc23174c08852cdbabbb0cca10b938c9c1ae73dae775bf83dd8977f65fc54955fe593dc32bede246002c310d32bad33a21c183c212ff0092ff6c2d
SSDEEP

24576:+oAXT+u1Ngb1FPQgfqIRknfKtefSTpME2ZRh4r:+H6uWMmqfSTGEmL4r

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral20/memory/3952-0-0x0000000000400000-0x000000000071D000-memory.dmp	upx
behavioral20/memory/3952-2-0x0000000000400000-0x000000000071D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	3952	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jpdesk.exe

C:\Users\Admin\AppData\Local\Temp\jpdesk.exe
"C:\Users\Admin\AppData\Local\Temp\jpdesk.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 560
  2⤵
  - Program crash
  PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3952 -ip 3952
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-0-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/3952-1-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/3952-2-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download