388546f7d002e47b9f4246c5eea889320a21612f6d551d0b6dbe2a94d891054e

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2024, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

388546f7d002e47b9f4246c5eea889320a21612f6d551d0b6dbe2a94d891054eN.exe
Size

83KB
MD5

47cd50fc70a56a0ef1b804c86f9ecbb0
SHA1

6695965ba4da1d3e1031e6d92fb00264a2aec212
SHA256

388546f7d002e47b9f4246c5eea889320a21612f6d551d0b6dbe2a94d891054e
SHA512

72a67f34fd8c0ffa94ca8068ef115f2fd1b17d201b72c1dda35198370f9a97f576e4ee5f4165a6af228fb5a16b2ea4dbc87a31da749380d3f36a69a19801106e
SSDEEP

1536:f2EwQ6n5OkWmMc5ZaJNCB5AJs/Fn1S+cr+6Pt:ft16n5OkhBOPC/p/FnncrfP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1124	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	388546f7d002e47b9f4246c5eea889320a21612f6d551d0b6dbe2a94d891054eN.exe

C:\Users\Admin\AppData\Local\Temp\388546f7d002e47b9f4246c5eea889320a21612f6d551d0b6dbe2a94d891054eN.exe
"C:\Users\Admin\AppData\Local\Temp\388546f7d002e47b9f4246c5eea889320a21612f6d551d0b6dbe2a94d891054eN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 204
  2⤵
  - Program crash
  PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1124 -ip 1124
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...