ebcc0fc0252825206072a9fac8ea36c2edaa20d7efdebc35fdfe4aa6c356d9a8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/12/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebcc0fc0252825206072a9fac8ea36c2edaa20d7efdebc35fdfe4aa6c356d9a8.exe
Size

547KB
MD5

289785d22ac3530633ca1cba953c9075
SHA1

7c18368ccd4d041c1ae0cf92abfe095ee65883f6
SHA256

ebcc0fc0252825206072a9fac8ea36c2edaa20d7efdebc35fdfe4aa6c356d9a8
SHA512

ed70954d2e91d184fa97a6a25e454ee3d4d1afe524944197f205b6911173020af86f503f1fdfc673f0d2bbc974e1eba3ea44ede9c5a79798c785155e61bb8f4f
SSDEEP

12288:V8rdnBlu0T855BfOr9cxv5swHW5AnlxJjWbDdwS/GahTZy+Pf5Tw2khhHIaxQA:VqZuqc5Er2xv5swZnl3jWBTZVf5Twthl

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2220	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebcc0fc0252825206072a9fac8ea36c2edaa20d7efdebc35fdfe4aa6c356d9a8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2660	2220	ebcc0fc0252825206072a9fac8ea36c2edaa20d7efdebc35fdfe4aa6c356d9a8.exe	31
PID 2220 wrote to memory of 2660	2220	ebcc0fc0252825206072a9fac8ea36c2edaa20d7efdebc35fdfe4aa6c356d9a8.exe	31
PID 2220 wrote to memory of 2660	2220	ebcc0fc0252825206072a9fac8ea36c2edaa20d7efdebc35fdfe4aa6c356d9a8.exe	31
PID 2220 wrote to memory of 2660	2220	ebcc0fc0252825206072a9fac8ea36c2edaa20d7efdebc35fdfe4aa6c356d9a8.exe	31

C:\Users\Admin\AppData\Local\Temp\ebcc0fc0252825206072a9fac8ea36c2edaa20d7efdebc35fdfe4aa6c356d9a8.exe
"C:\Users\Admin\AppData\Local\Temp\ebcc0fc0252825206072a9fac8ea36c2edaa20d7efdebc35fdfe4aa6c356d9a8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 52
  2⤵
  - Program crash
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2220-1-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download