c30250a18d472e5c8379e8eaa939e0bf3cc87cfe991da6deba491a092afb0611

General

Target

Heart-Sender Priv8 Version/Heart-Sender-V1.2.exe
Size

1.5MB
MD5

175d1484e55c5b6f16bff5631b92c171
SHA1

b11901746a8143c558877ea42dfa1221874bfba5
SHA256

7119d9570d888f5ffcb8f3c54d8d962fc87d83fbdd34c96b951acb3d2889777f
SHA512

93fa8f0b5401ef5d6069bfecec897267fae61888d82058973687bb13bcfa684d3c29249703774c889efe5ae91efda0957098f1c3fd4d7a0eccec86184104537c
SSDEEP

12288:+7qKAAwzaQa3lsZtsW2NH8d98AsmZF3ARZ0AsEye7Zm8TPXWP:2xJwzaQa3Pc98pmZFQ3WP

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

WindowsApp1.exeHeart-Sender-V1.2.exeJavaUpdate.exe

pid process

3964 WindowsApp1.exe
448 Heart-Sender-V1.2.exe
1112 JavaUpdate.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

3752 netsh.exe

pid	process
3964	WindowsApp1.exe
448	Heart-Sender-V1.2.exe
1112	JavaUpdate.exe

pid	process
3752	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Heart-Sender-V1.2.exeWindowsApp1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Heart-Sender-V1.2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WindowsApp1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

JavaUpdate.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fb4647cd59a8f29058f4529d83344fa5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\JavaUpdate.exe\" .."	JavaUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fb4647cd59a8f29058f4529d83344fa5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\JavaUpdate.exe\" .."	JavaUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

JavaUpdate.exe

description pid process

Token: SeDebugPrivilege 1112 JavaUpdate.exe
Token: 33 1112 JavaUpdate.exe
Token: SeIncBasePriorityPrivilege 1112 JavaUpdate.exe

description	pid	process
Token: SeDebugPrivilege	1112	JavaUpdate.exe
Token: 33	1112	JavaUpdate.exe
Token: SeIncBasePriorityPrivilege	1112	JavaUpdate.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Heart-Sender-V1.2.exeWindowsApp1.exeJavaUpdate.exe

description	pid	process	target process
PID 4856 wrote to memory of 3964	4856	Heart-Sender-V1.2.exe	WindowsApp1.exe
PID 4856 wrote to memory of 3964	4856	Heart-Sender-V1.2.exe	WindowsApp1.exe
PID 4856 wrote to memory of 3964	4856	Heart-Sender-V1.2.exe	WindowsApp1.exe
PID 4856 wrote to memory of 448	4856	Heart-Sender-V1.2.exe	Heart-Sender-V1.2.exe
PID 4856 wrote to memory of 448	4856	Heart-Sender-V1.2.exe	Heart-Sender-V1.2.exe
PID 4856 wrote to memory of 448	4856	Heart-Sender-V1.2.exe	Heart-Sender-V1.2.exe
PID 3964 wrote to memory of 1112	3964	WindowsApp1.exe	JavaUpdate.exe
PID 3964 wrote to memory of 1112	3964	WindowsApp1.exe	JavaUpdate.exe
PID 3964 wrote to memory of 1112	3964	WindowsApp1.exe	JavaUpdate.exe
PID 1112 wrote to memory of 3752	1112	JavaUpdate.exe	netsh.exe
PID 1112 wrote to memory of 3752	1112	JavaUpdate.exe	netsh.exe
PID 1112 wrote to memory of 3752	1112	JavaUpdate.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Heart-Sender Priv8 Version\Heart-Sender-V1.2.exe
"C:\Users\Admin\AppData\Local\Temp\Heart-Sender Priv8 Version\Heart-Sender-V1.2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4856

C:\Users\Admin\AppData\Local\Temp\WindowsApp1.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsApp1.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3964

C:\Users\Admin\AppData\Roaming\JavaUpdate.exe
"C:\Users\Admin\AppData\Roaming\JavaUpdate.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\JavaUpdate.exe" "JavaUpdate.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:3752

C:\Users\Admin\AppData\Local\Temp\Heart-Sender-V1.2.exe
"C:\Users\Admin\AppData\Local\Temp\Heart-Sender-V1.2.exe"
2⤵
- Executes dropped EXE
PID:448

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Heart-Sender-V1.2.exe
Filesize
226KB

MD5
9c7691ff597e9efd7f796b31accb78e8

SHA1
81bb289aa37d182b60e86990376a375de7a8decc

SHA256
1624af752c9f85fd117fafb28feb42a079f283dc133cdcc5799810072a95a6cb

SHA512
739f187aaeda13b7ebef3918a965b8da4ee939cd3e60d36802768f52be7b08f5964b121d1e977f4c408ff8ae6aba02df4a4d37785735c2f70d8610551cbab135

Download Submit
C:\Users\Admin\AppData\Local\Temp\Heart-Sender-V1.2.exe
Filesize
226KB

MD5
9c7691ff597e9efd7f796b31accb78e8

SHA1
81bb289aa37d182b60e86990376a375de7a8decc

SHA256
1624af752c9f85fd117fafb28feb42a079f283dc133cdcc5799810072a95a6cb

SHA512
739f187aaeda13b7ebef3918a965b8da4ee939cd3e60d36802768f52be7b08f5964b121d1e977f4c408ff8ae6aba02df4a4d37785735c2f70d8610551cbab135

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsApp1.exe
Filesize
1.0MB

MD5
0f2aa87f7c7e6b11b911f71170ba1104

SHA1
03000e57f78fab7596c4c59aab06fda9c2e9d91d

SHA256
b596ca499b0af2b700d867b976d0d793a98431309f88ef306c62056d0315f857

SHA512
f2e7d5646490ed4cf1b3a8dbaa7490228f744d694c7642f4bd4d22a155235720f2fa5ac65b5e4adcd443139e12a630198dd8d558d977c90bf1802851b7e54fb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsApp1.exe
Filesize
1.0MB

MD5
0f2aa87f7c7e6b11b911f71170ba1104

SHA1
03000e57f78fab7596c4c59aab06fda9c2e9d91d

SHA256
b596ca499b0af2b700d867b976d0d793a98431309f88ef306c62056d0315f857

SHA512
f2e7d5646490ed4cf1b3a8dbaa7490228f744d694c7642f4bd4d22a155235720f2fa5ac65b5e4adcd443139e12a630198dd8d558d977c90bf1802851b7e54fb9

Download Submit
C:\Users\Admin\AppData\Roaming\JavaUpdate.exe
Filesize
1.0MB

MD5
0f2aa87f7c7e6b11b911f71170ba1104

SHA1
03000e57f78fab7596c4c59aab06fda9c2e9d91d

SHA256
b596ca499b0af2b700d867b976d0d793a98431309f88ef306c62056d0315f857

SHA512
f2e7d5646490ed4cf1b3a8dbaa7490228f744d694c7642f4bd4d22a155235720f2fa5ac65b5e4adcd443139e12a630198dd8d558d977c90bf1802851b7e54fb9

Download Submit
C:\Users\Admin\AppData\Roaming\JavaUpdate.exe
Filesize
1.0MB

MD5
0f2aa87f7c7e6b11b911f71170ba1104

SHA1
03000e57f78fab7596c4c59aab06fda9c2e9d91d

SHA256
b596ca499b0af2b700d867b976d0d793a98431309f88ef306c62056d0315f857

SHA512
f2e7d5646490ed4cf1b3a8dbaa7490228f744d694c7642f4bd4d22a155235720f2fa5ac65b5e4adcd443139e12a630198dd8d558d977c90bf1802851b7e54fb9

Download Submit
memory/448-144-0x0000000004C00000-0x0000000004C92000-memory.dmp

Filesize
584KB

Download
memory/448-140-0x00000000001A0000-0x00000000001DE000-memory.dmp

Filesize
248KB

Download
memory/448-143-0x0000000009750000-0x0000000009CF4000-memory.dmp

Filesize
5.6MB

Download
memory/448-145-0x0000000004B80000-0x0000000004B8A000-memory.dmp

Filesize
40KB

Download
memory/448-146-0x0000000008420000-0x0000000008442000-memory.dmp

Filesize
136KB

Download
memory/448-136-0x0000000000000000-mapping.dmp

Download
memory/1112-147-0x0000000000000000-mapping.dmp

Download
memory/3752-150-0x0000000000000000-mapping.dmp

Download
memory/3964-141-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/3964-142-0x0000000004B10000-0x0000000004BAC000-memory.dmp

Filesize
624KB

Download
memory/3964-133-0x0000000000000000-mapping.dmp

Download
memory/4856-139-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download
memory/4856-132-0x00000000749C0000-0x0000000074F71000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads