6bf22d3dad8fea65c751f514871c6cd2913727cbb700ebcfed482f0dcb04e639

Analysis

max time kernel
94s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER#710665_PDF.exe
Size

227KB
MD5

e3f8392aa03280bb36a3dc058e44fca5
SHA1

2f7efa75f8c1d791007a006bd820a2f735b7fb22
SHA256

cc0e5224224cd1137d4cdff798462d06a7e5e39e97858aac2ecc3c27b5c30b42
SHA512

5323da860079bf60e6f96dc6a99f2d50e086279b9563d1c5173ed3d17a02fbffa304be01c5f31e20c35e1d18c2891d00dda888cdaf54aae9e5c29b5381856faa
SSDEEP

6144:PUd4OmBdYEOOTIPm1+F0lwq/xBQe+UKy9q:CNsvOxPmsWlwq5togq

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
400	3528	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ORDER#710665_PDF.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 1508	3528	ORDER#710665_PDF.exe	84
PID 3528 wrote to memory of 1508	3528	ORDER#710665_PDF.exe	84
PID 3528 wrote to memory of 1508	3528	ORDER#710665_PDF.exe	84

C:\Users\Admin\AppData\Local\Temp\ORDER#710665_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER#710665_PDF.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Local\Temp\ORDER#710665_PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER#710665_PDF.exe"
  2⤵
  PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 444
  2⤵
  - Program crash
  PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3528 -ip 3528
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3528-0-0x0000000000403000-0x0000000000404000-memory.dmp

Filesize
4KB

Download
memory/3528-1-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download