395182f2d8e01c68f8d20201f166d6ec2d9e42cc61b053f91cad961881bab742

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

395182f2d8e01c68f8d20201f166d6ec2d9e42cc61b053f91cad961881bab742N.exe
Size

428KB
MD5

b5e5239715ab0bbc7002efdb09f4e320
SHA1

0c7065c04338d1e2dfc241ac759d6994c50123bc
SHA256

395182f2d8e01c68f8d20201f166d6ec2d9e42cc61b053f91cad961881bab742
SHA512

03b55ac4df2f68bf483722965e7b9a2d9594dbc7b352d52dafb98ce5a1e1d9d1492e7db4f43755a9d85f238af4bacdfb79d29691bcae09d7965c1879e4ff6906
SSDEEP

6144:vi7oIVXiBE28QnDBuytjoSpi7oIVJkiBE28QnDBuytjoS:CoI4W2jZoS4oIX7W2jZoS

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3680	2412	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	395182f2d8e01c68f8d20201f166d6ec2d9e42cc61b053f91cad961881bab742N.exe

C:\Users\Admin\AppData\Local\Temp\395182f2d8e01c68f8d20201f166d6ec2d9e42cc61b053f91cad961881bab742N.exe
"C:\Users\Admin\AppData\Local\Temp\395182f2d8e01c68f8d20201f166d6ec2d9e42cc61b053f91cad961881bab742N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 216
  2⤵
  - Program crash
  PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2412 -ip 2412
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-0-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download