08fd9450c2e99c481596f8429423f3ac13c69f0d6cea641a2652c351257a7801

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

08fd9450c2e99c481596f8429423f3ac13c69f0d6cea641a2652c351257a7801.exe
Size

913KB
MD5

0a1a8ee76fcbcc6ca657fb071faea9e1
SHA1

dc554550c0a63883edd4c5b3800b017558097a5f
SHA256

08fd9450c2e99c481596f8429423f3ac13c69f0d6cea641a2652c351257a7801
SHA512

d298bddfb737e277a8819a072ecf67ac347084acf23fee12b1d9416714bcd1b03dd8546eacc3070f8acdb8486066b6a449991bb69d6fd7cbc7ccdd43a8131942
SSDEEP

12288:Q7pY1attQjt+8uLTjxf6kFUFq7RYLCX0W/:Q79etoj96kWIYE/

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4192	2968	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08fd9450c2e99c481596f8429423f3ac13c69f0d6cea641a2652c351257a7801.exe

C:\Users\Admin\AppData\Local\Temp\08fd9450c2e99c481596f8429423f3ac13c69f0d6cea641a2652c351257a7801.exe
"C:\Users\Admin\AppData\Local\Temp\08fd9450c2e99c481596f8429423f3ac13c69f0d6cea641a2652c351257a7801.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1048
  2⤵
  - Program crash
  PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2968 -ip 2968
1⤵
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/2968-1-0x0000000000360000-0x000000000044A000-memory.dmp

Filesize
936KB

Download
memory/2968-2-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download
memory/2968-3-0x00000000055F0000-0x0000000005682000-memory.dmp

Filesize
584KB

Download
memory/2968-4-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/2968-5-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/2968-6-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download