a2d3d6430f6775951cf988d960cfae4093d7a1e4d0f684ddfffaf4599ace9a71

Resubmissions

11-11-2024 03:14

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 03:14

Target

WSHSetup[1].exe
Size

898KB
MD5

cb2b4cd74c7b57a12bd822a168e4e608
SHA1

f2182062719f0537071545b77ca75f39c2922bf5
SHA256

5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed
SHA512

7a38be8c1270b1224be4975ad442a964b2523c849f748e5356156cdce39e494c64ca80b0d99c1d989d77f072902de8972e0b113894c9791fb0cabf856dbba348
SSDEEP

12288:vI3h+hoVEZnvy/hF4CMWZrU7S/iAfMIItotPP2rbPCrF7:vu+hIE9BYO7S/iAOtc4be

Score

3^/10

discovery

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2684 2840 WerFault.exe WSHSetup[1].exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

WSHSetup[1].exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSHSetup[1].exe

pid	pid_target	process	target process
2684	2840	WerFault.exe	WSHSetup[1].exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSHSetup[1].exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WSHSetup[1].exe

description	pid	process	target process
PID 2840 wrote to memory of 2684	2840	WSHSetup[1].exe	WerFault.exe
PID 2840 wrote to memory of 2684	2840	WSHSetup[1].exe	WerFault.exe
PID 2840 wrote to memory of 2684	2840	WSHSetup[1].exe	WerFault.exe
PID 2840 wrote to memory of 2684	2840	WSHSetup[1].exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\WSHSetup[1].exe
"C:\Users\Admin\AppData\Local\Temp\WSHSetup[1].exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 936
  2⤵
  - Program crash
  PID:2684

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2840-0-0x00000000001A0000-0x00000000001D3000-memory.dmp

Filesize
204KB

Download
memory/2840-1-0x00000000012B0000-0x0000000001398000-memory.dmp

Filesize
928KB

Download
memory/2840-2-0x00000000001A0000-0x00000000001D3000-memory.dmp

Filesize
204KB

Download
memory/2840-3-0x00000000012B0000-0x0000000001398000-memory.dmp

Filesize
928KB

Download