de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe
Size

256KB
MD5

b9aab74e4ab1ab4ae46c5edb9360816d
SHA1

b1276357a4cff8258229e687943d6c32caed6271
SHA256

de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e
SHA512

14d47ea92d685d00f036d1ac1a44fe470381d08d183793f093db0c9efba22cec7a9183424f022e1fa830fbd011e6c432a08bfb03368d45276da0285e5ac0550e
SSDEEP

3072:LQkOMyBybJS3a7eJx7ERvhP/zOHYVvz/ktpbGo2zyZT21dFYzeug3oafI0hKKKEW:LQc7eJIha4Vv7krImFIjFrbc67dANb

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1060	de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe

Executes dropped EXE 1 IoCs

pid	Process
1060	de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3424	1896	WerFault.exe	82
2988	1060	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1896	de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1060	de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1060	1896	de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe	90
PID 1896 wrote to memory of 1060	1896	de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe	90
PID 1896 wrote to memory of 1060	1896	de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe	90

C:\Users\Admin\AppData\Local\Temp\de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe
"C:\Users\Admin\AppData\Local\Temp\de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 396
  2⤵
  - Program crash
  PID:3424
- C:\Users\Admin\AppData\Local\Temp\de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe
  C:\Users\Admin\AppData\Local\Temp\de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 364
    3⤵
    - Program crash
    PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1896 -ip 1896
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1060 -ip 1060
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\de7ee9213e3a8ee463fc8ce3af2a24a743d1c0f35ff07cf554c972f8fc24317e.exe

Filesize
256KB

MD5
9f7429e332a89e671a0506722a87ec47

SHA1
6edef4d51c582c1080cecb21c21d3ee83a615688

SHA256
a62948070994b5b24221d420ff2f6ccef48f1baac61b8c07c9c9bd9b721b926a

SHA512
4e97d43800785914763bb9629fba9f0d8f4c3e2284b9bafbababb1542bd9c9db98ce1c9144671ed03d72e414d6e938ab0af332a3c7629dab79d31f7ab2ad5c8f

Download Submit
memory/1060-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1060-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1060-13-0x0000000004D50000-0x0000000004D8E000-memory.dmp

Filesize
248KB

Download
memory/1060-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1896-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1896-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download