80c896a08d7847ff7d282d383deb7b753b2bd3e06e6cb3dbe7731adcae32197d

Analysis

max time kernel
102s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
06/08/2025, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Request for Proposal Summer project TPO23010055-(TP)^....%100% dwg.exe
Size 714KB
Sample250806-m97faavygx
SHA256 80c896a08d7847ff7d282d383deb7b753b2bd3e06e6cb3dbe7731adcae32197d
MD5 a2af576a21d00ec089b270e00687af35
SHA1 10261d9d4cc3187ce3cdb5df02c5ce304bf5edba
SHA512 f17528ed6b846c9d8b0354135c07fef4a213574017969d857969e6dc1444f6c219ef8eb7f8ca72fdd80758d7d4c59f938bd00cd7a2a3047aa3e7ea0456e5fc15
SSDEEP 12288:P3NxTevnFY9G3oWLGe+0AVxHy9S02IxjQgJGQ/fZY/fgD2A0Qbodcz52gv5uLzTX:vNaUske+0A+U+BqZ/f+90Qbm0KnyV/2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5136	2960	WerFault.exe	77

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Request for Proposal Summer project TPO23010055-(TP)^....%100% dwg.exe

C:\Users\Admin\AppData\Local\Temp\Request for Proposal Summer project TPO23010055-(TP)^....%100% dwg.exe
"C:\Users\Admin\AppData\Local\Temp\Request for Proposal Summer project TPO23010055-(TP)^....%100% dwg.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 784
  2⤵
  - Program crash
  PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2960 -ip 2960
1⤵
PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-0-0x0000000000430000-0x00000000004E8000-memory.dmp

Download