c1a148b353ceabecd13c5e1097efb20b13f0b46b2f15dd50bf906773a205d0e7

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inlaweed324456.exe
Size

216KB
MD5

aa9acee000034360ef72e014b05e775c
SHA1

2e424b2812e789a76315fe7ee2977c2fb802e568
SHA256

0d0f9826df61da68a73b28700102eb7c15f3d3dac4925b56b08a4c9ef89ab743
SHA512

1d881aed0cdfd9f7e0cb6a883040b763c07e9428627384984e23e65bd24e30897ed05881e106d1e55dd4b13a6d3b3682fb198299e53cc1b8d94aa28c420804fc
SSDEEP

3072:F14/IIhEDnmJ+xjJiGIykqSqbNjXGK86HBmx6k6qzUCa0lCVUyy+ZFsH5:FbUIZX58YQ8DqPa06UyjZF+5

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1108	ughxrz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4120	1108	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inlaweed324456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ughxrz.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1108	1512	inlaweed324456.exe	82
PID 1512 wrote to memory of 1108	1512	inlaweed324456.exe	82
PID 1512 wrote to memory of 1108	1512	inlaweed324456.exe	82
PID 1108 wrote to memory of 3448	1108	ughxrz.exe	83
PID 1108 wrote to memory of 3448	1108	ughxrz.exe	83
PID 1108 wrote to memory of 3448	1108	ughxrz.exe	83

C:\Users\Admin\AppData\Local\Temp\inlaweed324456.exe
"C:\Users\Admin\AppData\Local\Temp\inlaweed324456.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\ughxrz.exe
  C:\Users\Admin\AppData\Local\Temp\ughxrz.exe C:\Users\Admin\AppData\Local\Temp\kunwbqbivl
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\ughxrz.exe
    C:\Users\Admin\AppData\Local\Temp\ughxrz.exe C:\Users\Admin\AppData\Local\Temp\kunwbqbivl
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 600
    3⤵
    - Program crash
    PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1108 -ip 1108
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dsi54bg0l05gki

Filesize
184KB

MD5
ab7b842a222f7f292b046687f4beeb8b

SHA1
c0ebb3975cb4fa454c535915f2277cbda26c20e3

SHA256
84e167d1ed138c82b3e90a332e4cce207da3cbe6763c2d1f93d51e6ab7d7b8d1

SHA512
5b212f17abdc3e5e35d70ac00e703a5d8664f569b0a07c3e143887016e58b104d251de6b0c136ec900bfe5c6047505d0c45014e8235e1b8992689a32cfbfefa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\kunwbqbivl

Filesize
4KB

MD5
ebcbecf083bd04fdc4f19036eced42ce

SHA1
59ac3f77b1c64b6f0aed95404e8a5ca6bab762cb

SHA256
27eacff6815497d148c2661aae0883833a5b2df12ea05d573145b343c32f8e4c

SHA512
4e6de66ba7564822e273077772fccf1d82dd90a87ad58c1a14a99d9fbf9a229dfb2ebb9a35cff1ad56f0c0ccff39b42bf36daf57810e9f0402a0cac470928ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ughxrz.exe

Filesize
4KB

MD5
86ec26587378d1a1ff33ce1aa2680fba

SHA1
577ba29772044952e70cfab3f9c08c06a4272314

SHA256
192fba7e71f2f2e0d53c8ac2b9a0ce20c489b8d8306e44cd025fa0fd3bfc5229

SHA512
e0c309435494918579379c4c1ccfc8f03ab8bd474c1f142179d5050bc99693ba08ea2cdda88e22bf1e7c12ac634aa15ed08dfd4b5a78e464c33ac495bf9f4f60

Download Submit
memory/1108-7-0x00000000006B0000-0x00000000006B2000-memory.dmp

Filesize
8KB

Download