5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe
Size

77.0MB
MD5

01f9c9f129a9de9d594addb7c32d194d
SHA1

5a6939cfb1c3d920864c9d996da223f0f3eee59f
SHA256

5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344
SHA512

2b2c2cb45cf5b9d5fab6ebb6ea747ba5672fa10f9dc1337961051585c2457cfe045d58a1c0d0d38d250d34f2f7b6dce92b2fbdde2cf3ec200675ee3843285abc
SSDEEP

24576:du6J33O0c+JY5UZ+XC0kGso6Facv3wma2g6Tm0WY:vu0c++OCvkGs9FacfwnJY

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4572	1940	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1940	5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe
1940	5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1940	5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe
1940	5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1304	1940	5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe	83
PID 1940 wrote to memory of 1304	1940	5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe	83
PID 1940 wrote to memory of 1304	1940	5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe	83

C:\Users\Admin\AppData\Local\Temp\5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe
"C:\Users\Admin\AppData\Local\Temp\5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\5c68b2915de0bd72f32898d3eeefb4349f973863b78e5bf74c6db1ec94c29344.exe"
  2⤵
  PID:1304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 696
  2⤵
  - Program crash
  PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1940 -ip 1940
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-11-0x00000000014E0000-0x00000000018E0000-memory.dmp

Filesize
4.0MB

Download