Analysis
-
max time kernel
94s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2024 14:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Płatność 8557899,jpg.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
Płatność 8557899,jpg.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
300 seconds
General
-
Target
Płatność 8557899,jpg.exe
-
Size
1.1MB
-
MD5
741eea55925237502bf85c1b86e4012b
-
SHA1
0104879889fd5440e59978a98d6f715fa4a79c86
-
SHA256
678fa6d49ff14e29a6a534db4ac0ad1f3aa9538101d2b6ed4aef40cedd8b4339
-
SHA512
ab917b2694b00daeacbda1d82c72259316a4753e991e80ee0f2aa247d7df90268cdf46b27a2b166cfcb36b6ecd0e0ab4476b08aa138a66f0c634bbea100aaeb1
-
SSDEEP
24576:Hu6J33O0c+JY5UZ+XC0kGso6Fa/tgAKWY:Bu0c++OCvkGs9Fa/tgYY
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1040 3684 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Płatność 8557899,jpg.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3684 Płatność 8557899,jpg.exe 3684 Płatność 8557899,jpg.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3684 Płatność 8557899,jpg.exe 3684 Płatność 8557899,jpg.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3684 wrote to memory of 1052 3684 Płatność 8557899,jpg.exe 82 PID 3684 wrote to memory of 1052 3684 Płatność 8557899,jpg.exe 82 PID 3684 wrote to memory of 1052 3684 Płatność 8557899,jpg.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Płatność 8557899,jpg.exe"C:\Users\Admin\AppData\Local\Temp\Płatność 8557899,jpg.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Płatność 8557899,jpg.exe"2⤵PID:1052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 6922⤵
- Program crash
PID:1040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3684 -ip 36841⤵PID:1368