8d82945bd5782a593aa632fdb3fe3b651893e434545b8c22e4576b3a2a0248d8

Analysis

max time kernel
94s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PURCHASE ORDER.exe
Size

551KB
MD5

0a1689698e15f2d5a7779a850b46217b
SHA1

7aeaced0fde2314490aa1c40025d4c10a60efcce
SHA256

789299ea329d9ab7fcb7043cf50dd4321ae3878c7f8eeb3136b5ed04ce2626e0
SHA512

4fb7c1317b8ea4a484ab8b8e5b84a2673734f75765af55dda6fd032be21f696a69816b15f13569dd3957897c874a55eeae01ddc09ee5a9f2839cc7e3c9354350
SSDEEP

12288:NP7r9r/+ppppppppppppppppppppppppppppp0YJwjyHyBK/LWCNyTrz9h74:N1MbTL/wvLU

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

vxrlhg.exe

pid	Process
3564	vxrlhg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
5052	3564	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

PURCHASE ORDER.exevxrlhg.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PURCHASE ORDER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vxrlhg.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

PURCHASE ORDER.exevxrlhg.exe

description	pid	Process	procid_target
PID 4816 wrote to memory of 3564	4816	PURCHASE ORDER.exe	82
PID 4816 wrote to memory of 3564	4816	PURCHASE ORDER.exe	82
PID 4816 wrote to memory of 3564	4816	PURCHASE ORDER.exe	82
PID 3564 wrote to memory of 2268	3564	vxrlhg.exe	84
PID 3564 wrote to memory of 2268	3564	vxrlhg.exe	84
PID 3564 wrote to memory of 2268	3564	vxrlhg.exe	84

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\vxrlhg.exe
  C:\Users\Admin\AppData\Local\Temp\vxrlhg.exe C:\Users\Admin\AppData\Local\Temp\tjzfybzskq
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Users\Admin\AppData\Local\Temp\vxrlhg.exe
    C:\Users\Admin\AppData\Local\Temp\vxrlhg.exe C:\Users\Admin\AppData\Local\Temp\tjzfybzskq
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 612
    3⤵
    - Program crash
    PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3564 -ip 3564
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\et3cra8zhyjmrm2jktsg

Filesize
285KB

MD5
93204c274660dc48195abcb69f9feb98

SHA1
aec1f57e2b5d13c2e890a9a85779690d20ac5eef

SHA256
3a7051d9961b5ebd0c7f29b989165de72bc6c786f82f0038e89905596f790c85

SHA512
42c42e92e1445ab965711a167a8fa0ff616df6fdf0142b4798cdf03ec0ea5aa3b4af1c29d84d5834afa9fb1ded611c3380042fb08625a9ef45d51e1100c6b606

Download Submit
C:\Users\Admin\AppData\Local\Temp\tjzfybzskq

Filesize
4KB

MD5
41e93b996c8af83bf3d4b728ac7df71a

SHA1
3a143f132d7fc9c97b872fdceb30531b59af5ead

SHA256
f42e50d794d6f6ffae8c14af097bc050091f435603a6b236b986d9b8d7e6a4b6

SHA512
4a19306838dbcd51ac6eb2d4d2625769834dc2fc0f297949f5b7467d5f32d54e4c81433cb2d39e141a644c767bf6c06bc7ed2ab5396256cf8c4e4b1ad92b1e1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vxrlhg.exe

Filesize
170KB

MD5
80fee08628f07e4a7b845cc50733dacc

SHA1
01293924c19486df0c778f367bd91570d2a8fe23

SHA256
1e636514dc1362a291840f1b2752c61c94914061296df098b176956681f14d77

SHA512
177df61cb33e7fb15b2e9226006871265ea729ca8a2f7ad6f36c6372f6d43171d05bc7821a5bc09e5e215f328414fb0f0e3ecaa0cd39ec5cd970f8515a93e5e7

Download Submit
memory/3564-8-0x0000000002190000-0x0000000002192000-memory.dmp

Filesize
8KB

Download