e2c8d079f2b4bb14ff371b3999f078f7cbfae0d52ab8cc99a803e9e13a0578ac

General

Target

044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe
Size

277KB
MD5

07472f63bdec0c4a83767d19b8b7ba19
SHA1

32392707ddac27ef3cb0baa8365ba11d326e86ce
SHA256

044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6
SHA512

259dc8f8303b6be1fde58f090d2f628c80f9cab83be4df93b0b272e3073658cf9504acab7795df0727d900a025d9c2e5d1e7801a2f14c571f04e8b10a26f01ab
SSDEEP

6144:A4qCIulquAQ40xAkvW2jxcbK9kMYzX/Qt8AsH7m2vOlPegMIOGd:DI6lAQ403vjjxcbKwr+8/sQgH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 set thread context of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1132	3524	WerFault.exe	82
3532	5116	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 3524	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	82
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83
PID 4720 wrote to memory of 5116	4720	044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe	83

C:\Users\Admin\AppData\Local\Temp\044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe
"C:\Users\Admin\AppData\Local\Temp\044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe
  C:\Users\Admin\AppData\Local\Temp\044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe
  2⤵
  PID:3524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 80
    3⤵
    - Program crash
    PID:1132
- C:\Users\Admin\AppData\Local\Temp\044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe
  C:\Users\Admin\AppData\Local\Temp\044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6.exe
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 80
    3⤵
    - Program crash
    PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3524 -ip 3524
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5116 -ip 5116
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4720-0-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

Filesize
4KB

Download
memory/4720-1-0x0000000000F20000-0x0000000000F6C000-memory.dmp

Filesize
304KB

Download
memory/4720-2-0x0000000005890000-0x00000000058E8000-memory.dmp

Filesize
352KB

Download
memory/4720-3-0x0000000007E70000-0x0000000007F0C000-memory.dmp

Filesize
624KB

Download
memory/4720-4-0x00000000084C0000-0x0000000008A64000-memory.dmp

Filesize
5.6MB

Download
memory/4720-5-0x0000000007FB0000-0x0000000008042000-memory.dmp

Filesize
584KB

Download
memory/4720-6-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4720-10-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing