Analysis
-
max time kernel
137s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 07:43
Static task
static1
Behavioral task
behavioral1
Sample
Maksājums10312024,jpg.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Maksājums10312024,jpg.exe
Resource
win10v2004-20241007-en
General
-
Target
Maksājums10312024,jpg.exe
-
Size
1.4MB
-
MD5
d155bbf3b7aeebfcd96f0ad99ab8d634
-
SHA1
22150906ad0e14b9385ae7fd079f37d960be4213
-
SHA256
140f74d6834ec93d4279dd1f3c9efe3a0a68c8ee78a63cb9556d990fd6753fe5
-
SHA512
eb3b5ff3b002329bb6ea0e1c1ed30d0273b361984dfc8942f1d5cc34f4462d9499cfbfb8742f6f31d93f3416c6936c00aa379cc3f5b0a6f78380746f1f12dc6c
-
SSDEEP
24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8aTdo8vtaByatj8iZCMkb0k//Mz:sTvC/MTQYxsWR7aTNveHtRZCM+M
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2180 4152 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Maksājums10312024,jpg.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Maksājums10312024,jpg.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Maksājums10312024,jpg.exedescription pid Process procid_target PID 4152 wrote to memory of 2852 4152 Maksājums10312024,jpg.exe 98 PID 4152 wrote to memory of 2852 4152 Maksājums10312024,jpg.exe 98 PID 4152 wrote to memory of 2852 4152 Maksājums10312024,jpg.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\Maksājums10312024,jpg.exe"C:\Users\Admin\AppData\Local\Temp\Maksājums10312024,jpg.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Maksājums10312024,jpg.exe"2⤵PID:2852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 6242⤵
- Program crash
PID:2180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4152 -ip 41521⤵PID:1784