bd8c4f03932fa0171cf1fbd040d50269c1e3b7c7d84b04975753b3247e4652db

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd8c4f03932fa0171cf1fbd040d50269c1e3b7c7d84b04975753b3247e4652dbN.exe
Size

187KB
MD5

f038c8abcb879e38bf27acb8db28e2a0
SHA1

1c1fc5e80fd8b284607cfbaf9b8bf9b0cc58cdb4
SHA256

bd8c4f03932fa0171cf1fbd040d50269c1e3b7c7d84b04975753b3247e4652db
SHA512

637d73485aed793f9bada597a58593d8f5a0a9fbae862e7dea46fc6864c933bd5f84babcc1355d7418c5d147bc10732bb1e6408ad2792ed744011a8775d60f8d
SSDEEP

3072:fb9fR6vPhkm9gDdMM9T4wYkgVGIeuK9RWZBmVPKCuoyH:fb9J6BkDdMMCwYkgwbu2VVPnuoU

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3424	2620	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd8c4f03932fa0171cf1fbd040d50269c1e3b7c7d84b04975753b3247e4652dbN.exe

C:\Users\Admin\AppData\Local\Temp\bd8c4f03932fa0171cf1fbd040d50269c1e3b7c7d84b04975753b3247e4652dbN.exe
"C:\Users\Admin\AppData\Local\Temp\bd8c4f03932fa0171cf1fbd040d50269c1e3b7c7d84b04975753b3247e4652dbN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 356
  2⤵
  - Program crash
  PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2620 -ip 2620
1⤵
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads