c40aa72fc9f9bc5c564da55eef71319d77402660f2d293f061d0ae8660e7cda9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝗦𝗲𝘁𝘂𝗽_patched.exe
Size 16.1MB
Sample250321-y41lbsytht
SHA256 c40aa72fc9f9bc5c564da55eef71319d77402660f2d293f061d0ae8660e7cda9
MD5 6b8d1553e96ce4f7074b4cebc7706805
SHA1 9b71e03b3f3269f8daf2dc360e32ab83b32f9b67
SHA512 1ca73f02661b628fdcb2c0b12887e8ef9a06858c555b63a32ea62b41fa1a0fa16ab5f3e34b9da84e12e0aa29d40e5e26050aaed7add04c1669f0cf7b9595513c
SSDEEP 49152:AflMPE54FA3zBaZfuo3HYnPJ/kzSy/nClDzBaZfuo3HYnPJ9:A2E54FgzBaz3OxG7C1zBaz3Ox9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	1720	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝗦𝗲𝘁𝘂𝗽_patched.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1720	𝗦𝗲𝘁𝘂𝗽_patched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2532	1720	𝗦𝗲𝘁𝘂𝗽_patched.exe	30
PID 1720 wrote to memory of 2532	1720	𝗦𝗲𝘁𝘂𝗽_patched.exe	30
PID 1720 wrote to memory of 2532	1720	𝗦𝗲𝘁𝘂𝗽_patched.exe	30
PID 1720 wrote to memory of 2532	1720	𝗦𝗲𝘁𝘂𝗽_patched.exe	30

C:\Users\Admin\AppData\Local\Temp\𝗦𝗲𝘁𝘂𝗽_patched.exe
"C:\Users\Admin\AppData\Local\Temp\𝗦𝗲𝘁𝘂𝗽_patched.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 256
  2⤵
  - Program crash
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-0-0x0000000000320000-0x000000000038E000-memory.dmp

Download

memory/1720-1-0x0000000000320000-0x000000000038E000-memory.dmp

Download