aeb462a039e3ba25f59987f72aa4511c90e3632a611b8c283213160c8da0ed38

Analysis

max time kernel
94s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3548-0-0x0000000000200000-0x000000000089D000-memory.exe
Size

6.6MB
MD5

4810771c030c381a788e9028dbd29f11
SHA1

b954095bf8bf22d6f253da20c7bcd45a176cbcb5
SHA256

aeb462a039e3ba25f59987f72aa4511c90e3632a611b8c283213160c8da0ed38
SHA512

32af44e5fcf735d645ba5ab4a1dcc02c2fab072b5eb4fb372ed9ae4e22b82b5e57138d645274f715d129661a8315aac7c4e48ccd7fdebd4b9d850e51a2dcf187
SSDEEP

3072:nlMBIlrpB4rD5YTvr4MVPgNxbMAgp8pFlKw6/7winl4yQweAIs:mBQrkruT5JObMAWu2R/7jeyXeAI

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4140 2888 WerFault.exe 3548-0-0x0000000000200000-0x000000000089D000-memory.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

3548-0-0x0000000000200000-0x000000000089D000-memory.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3548-0-0x0000000000200000-0x000000000089D000-memory.exe

pid	pid_target	process	target process
4140	2888	WerFault.exe	3548-0-0x0000000000200000-0x000000000089D000-memory.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3548-0-0x0000000000200000-0x000000000089D000-memory.exe

C:\Users\Admin\AppData\Local\Temp\3548-0-0x0000000000200000-0x000000000089D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3548-0-0x0000000000200000-0x000000000089D000-memory.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 224
  2⤵
  - Program crash
  PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2888 -ip 2888
1⤵
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-0-0x0000000000940000-0x0000000000FDD000-memory.dmp

Filesize
6.6MB

Download