6ce2dc1aea1d062b35b2f1e1bb8ad276bede32a26e51581f996b4af620764863

Analysis

max time kernel
1562s
max time network
1564s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-11-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EVP3410001500995_1506489088-payment order.exe
Size

45KB
MD5

3d66305ed410fad27c043db895cdd385
SHA1

1038de840abc4effc9092a240c7fb8b088b7731b
SHA256

6ce2dc1aea1d062b35b2f1e1bb8ad276bede32a26e51581f996b4af620764863
SHA512

95d56b572aa8322b93a683e7827f6732c58f0c10f1cb41381df68072ecb6c58182ed418af4207f3e5666fd369224cafcc8ba8a5a3c9c71251abd58e0d65e719b
SSDEEP

384:d8vpxocE2w6L5FUGWe1fEt5m0Gg9azYUmreMRo5CRCV5uWn+FW:dIo/QnJ9gloz3MRRMi

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6024	2868	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EVP3410001500995_1506489088-payment order.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2868	EVP3410001500995_1506489088-payment order.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	EVP3410001500995_1506489088-payment order.exe
Token: SeDebugPrivilege	2868	EVP3410001500995_1506489088-payment order.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 6024	2868	EVP3410001500995_1506489088-payment order.exe	31
PID 2868 wrote to memory of 6024	2868	EVP3410001500995_1506489088-payment order.exe	31
PID 2868 wrote to memory of 6024	2868	EVP3410001500995_1506489088-payment order.exe	31
PID 2868 wrote to memory of 6024	2868	EVP3410001500995_1506489088-payment order.exe	31

C:\Users\Admin\AppData\Local\Temp\EVP3410001500995_1506489088-payment order.exe
"C:\Users\Admin\AppData\Local\Temp\EVP3410001500995_1506489088-payment order.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 520
  2⤵
  - Program crash
  PID:6024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Filesize
4KB

Download
memory/2868-1-0x00000000011C0000-0x00000000011D0000-memory.dmp

Filesize
64KB

Download
memory/2868-2-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-3-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Filesize
4KB

Download
memory/2868-4-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-5-0x0000000005F10000-0x0000000005FFE000-memory.dmp

Filesize
952KB

Download
memory/2868-6-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-7-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-11-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-13-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-15-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-21-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-23-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-25-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-27-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-33-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-35-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-37-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-39-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-41-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-43-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-31-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-29-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-19-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-17-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-9-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-57-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-65-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-45-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-53-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-69-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-67-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-1082-0x0000000001170000-0x00000000011BC000-memory.dmp

Filesize
304KB

Download
memory/2868-1081-0x0000000005530000-0x0000000005592000-memory.dmp

Filesize
392KB

Download
memory/2868-1080-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-63-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-61-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-59-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-55-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-51-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-49-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-47-0x0000000005F10000-0x0000000005FF9000-memory.dmp

Filesize
932KB

Download
memory/2868-1083-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-1084-0x0000000000F00000-0x0000000000F54000-memory.dmp

Filesize
336KB

Download
memory/2868-1085-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download