59f94ff9fa02e65e2ccaa22af592a32088ed265f82b43a369ef811150f65b381

Analysis

max time kernel
92s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
z37CurriculumVitaeIsabelGonzalez.exe
Size 1.1MB
Sample241223-sdwa2asqfl
SHA256 59f94ff9fa02e65e2ccaa22af592a32088ed265f82b43a369ef811150f65b381
MD5 cebc14097108206cf2149465b7ac4a23
SHA1 033a1ef67618c81ecc07d2be9816c387e00226c2
SHA512 f7bd2f64c567aa09aeec24659213862a020e5b6ecffa517487bacdf0c14d73d4d7734eca104adfc7d98d0a99a9f2710b3f76c56f61115c4206421e6cc7353604
SSDEEP 24576:aCdxte/80jYLT3U1jfsWatZ6Wy2Gh8j6/6VKQ:7w80cTsjkWatZ612Gh8jH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4348	1200	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z37CurriculumVitaeIsabelGonzalez.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1200	z37CurriculumVitaeIsabelGonzalez.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1200	z37CurriculumVitaeIsabelGonzalez.exe
1200	z37CurriculumVitaeIsabelGonzalez.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1200	z37CurriculumVitaeIsabelGonzalez.exe
1200	z37CurriculumVitaeIsabelGonzalez.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 3120	1200	z37CurriculumVitaeIsabelGonzalez.exe	83
PID 1200 wrote to memory of 3120	1200	z37CurriculumVitaeIsabelGonzalez.exe	83
PID 1200 wrote to memory of 3120	1200	z37CurriculumVitaeIsabelGonzalez.exe	83

C:\Users\Admin\AppData\Local\Temp\z37CurriculumVitaeIsabelGonzalez.exe
"C:\Users\Admin\AppData\Local\Temp\z37CurriculumVitaeIsabelGonzalez.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\z37CurriculumVitaeIsabelGonzalez.exe"
  2⤵
  PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 724
  2⤵
  - Program crash
  PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1200 -ip 1200
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut829E.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut829E.tmp
Size 281KB
SHA256 398d51b21aa49df70d71469dbfea4b3dbd1d38771742647dc15c3b713ff3a708
MD5 a05bca2ec1756c2a2f7782c98da1b0c3
SHA1 1850c225bc149bd8b584074da12d4b42bb6e7ad3
SHA512 cc30f2ce486c982737736293d5ce44f70d6d57137e2bd878da88864f93e31580ede897a02c737e303fb0ba704b4b56c4c82d2c6b8fe235b15630c52bf372de39
SSDEEP 6144:393Zj6+FcjIyG1k31pByg4OKq4+x85cqCUv7VwbE5KrQC:39pj6w8H3XByXn+x85VCUD2okMC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1200-13-0x0000000001250000-0x0000000001650000-memory.dmp

Download