Analysis
- max time kernel
97s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250508-en - resource tags
- submitted
14/05/2025, 05:15
General
- Target 0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
- Size 355KB
- Sample250514-fx2wpstry2
- SHA256 0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe"C:\Users\Admin\AppData\Local\Temp\0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 17002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2124 -ip 21241⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2124-0-0x000000007498E000-0x000000007498F000-memory.dmp
memory/2124-1-0x0000000000820000-0x0000000000880000-memory.dmp
memory/2124-2-0x0000000005840000-0x0000000005DE6000-memory.dmp
memory/2124-3-0x0000000005370000-0x0000000005402000-memory.dmp
memory/2124-4-0x0000000074980000-0x0000000075131000-memory.dmp
memory/2124-5-0x0000000005340000-0x000000000534A000-memory.dmp
memory/2124-6-0x0000000008030000-0x000000000855C000-memory.dmp
memory/2124-7-0x0000000007D30000-0x0000000007D4C000-memory.dmp
memory/2124-8-0x000000007498E000-0x000000007498F000-memory.dmp
memory/2124-9-0x0000000074980000-0x0000000075131000-memory.dmp
memory/2124-10-0x00000000086E0000-0x000000000872C000-memory.dmp
memory/2124-11-0x00000000087D0000-0x000000000886C000-memory.dmp
memory/2124-12-0x0000000074980000-0x0000000075131000-memory.dmp