8238ff6f1493c9c489bc0aba12e0cf6ac057875045c28a2a4b110a128f64c282

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44a0000.f8849031-05af-4cdc-98d3-848251cef52b.exe
Size

420KB
MD5

41eaa8668b6c030fbfe53f8c15169fd7
SHA1

503268c38f38983f26d2a9e8511f0ba13995282f
SHA256

f1039e4dc7dd8613f5fcb2f6ae5bd973eb9e3f41a67ef6cb2a7a0faceeda22b9
SHA512

6b08029827ce0b1df3ec60dee86e39ceac45a3a8661c9cf328d6a383c9723ba9706962ffa7dada0d37dab5ab6c3b6e8eb30cdebc5a0d0d8896dde842f3b09c7a
SSDEEP

6144:PgfzONv8tSLeCbKhVBIlKJXPrAbjfiUToabIObgNCF2Bs5fR/gMatS4ya8Ag:QzWleCbKhVB6KfWRbqJBs//gv

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3880 3160 WerFault.exe 44a0000.f8849031-05af-4cdc-98d3-848251cef52b.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

44a0000.f8849031-05af-4cdc-98d3-848251cef52b.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44a0000.f8849031-05af-4cdc-98d3-848251cef52b.exe

pid	pid_target	process	target process
3880	3160	WerFault.exe	44a0000.f8849031-05af-4cdc-98d3-848251cef52b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44a0000.f8849031-05af-4cdc-98d3-848251cef52b.exe

C:\Users\Admin\AppData\Local\Temp\44a0000.f8849031-05af-4cdc-98d3-848251cef52b.exe
"C:\Users\Admin\AppData\Local\Temp\44a0000.f8849031-05af-4cdc-98d3-848251cef52b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 468
  2⤵
  - Program crash
  PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3160 -ip 3160
1⤵
PID:3588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3160-0-0x0000000000463000-0x000000000046A000-memory.dmp

Filesize
28KB

Download