13af3ad92eb86c2c95c816ac526b97c78e0aaed46535c61bf363d768bb2cb0c9

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 20:05

Target

PO_2022-04-33981.exe
Size

924KB
MD5

0e9db60ad1bf774e9cee7b52cc145b4e
SHA1

322187dd46fc28a2727faac47b1efea50505a89a
SHA256

af573246f95b5eab9ae520005e00fd4e3f35e3488b2681e1a196d3e24eeb8c02
SHA512

a263b3bd59e70553a1b1c796a1faed85d8483dcca9f62c8f4b124e5263d240b6df9040a00da80d9752e58324d844ccd3ff8dbe41c24e57b9050e4ebf80f5e430
SSDEEP

12288:MbuvIyfL/alfmZlbbrekq/iI7hq/TUqzi9/k7a4sAMiAKUCPSQ/Dk7leWpLklyA4:MFcLhpex/iUqzuIaXbilBPvbk7hAlWp

Score

3^/10

discovery

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2016 1840 WerFault.exe PO_2022-04-33981.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

PO_2022-04-33981.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PO_2022-04-33981.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO_2022-04-33981.exe

description pid process

Token: SeDebugPrivilege 1840 PO_2022-04-33981.exe

pid	pid_target	process	target process
2016	1840	WerFault.exe	PO_2022-04-33981.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO_2022-04-33981.exe

description	pid	process
Token: SeDebugPrivilege	1840	PO_2022-04-33981.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PO_2022-04-33981.exe

description	pid	process	target process
PID 1840 wrote to memory of 2016	1840	PO_2022-04-33981.exe	WerFault.exe
PID 1840 wrote to memory of 2016	1840	PO_2022-04-33981.exe	WerFault.exe
PID 1840 wrote to memory of 2016	1840	PO_2022-04-33981.exe	WerFault.exe
PID 1840 wrote to memory of 2016	1840	PO_2022-04-33981.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO_2022-04-33981.exe
"C:\Users\Admin\AppData\Local\Temp\PO_2022-04-33981.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 624
  2⤵
  - Program crash
  PID:2016

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1840-0-0x000000007445E000-0x000000007445F000-memory.dmp

Filesize
4KB

Download
memory/1840-1-0x00000000010D0000-0x00000000011BE000-memory.dmp

Filesize
952KB

Download
memory/1840-2-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1840-3-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download