496298c862d7518d653d82a72ee93cc6de59f71b2467cf2c94ed5090b24e8767

Analysis

max time kernel
93s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

denemm.exe
Size

295KB
MD5

7789ef88a6fa2c4ef1613ff3193dbd06
SHA1

32112ad860eeb69e516939390d69129f24012dd1
SHA256

deec0fbcac5bd01d0894906b62654d6d9475bfc2890970cd4c972529aa609d6e
SHA512

c6c902c989afe8df35de5101c3e69fb4f107a28c4f4e073db31ff77677bd3cbbf2aa6b30d44c9f2326edc11bab979c42c379c2958813b17726c66f12041e4bcc
SSDEEP

6144:RZq5p6OTPiSS/KsKHPWE8auRg0x2hZD0xlPoVeavupI:3q5LPiSDHPWE8TRg0xkl0xCVWpI

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4504	2556	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	denemm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2556	denemm.exe
2556	denemm.exe

C:\Users\Admin\AppData\Local\Temp\denemm.exe
"C:\Users\Admin\AppData\Local\Temp\denemm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 816
  2⤵
  - Program crash
  PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2556 -ip 2556
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2556-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2556-4-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download