Analysis
-
max time kernel
58s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2023 01:40
Static task
static1
Behavioral task
behavioral1
Sample
HeartsOnFire.exe
Resource
win10v2004-20230831-en
General
-
Target
HeartsOnFire.exe
-
Size
37KB
-
MD5
0f9c5a108cc9a63092351b60abbd7bb8
-
SHA1
ae77d80bf23f920a4298e9992816bd96d8cd5900
-
SHA256
1115c7829a5da053a0e3d2951a8dcde6dae2d31db9bc7f514d36db9475fa2bd2
-
SHA512
db51f6f327276a7732f857220b7bc2ccbe48e0b9e7a3cc6ffbdc197bef9976b184babebcc2a45b2e9301a7e7d9fd29a818d40a3b4cc5e0cf8b6f646770772e1b
-
SSDEEP
384:sqTY1XxtJvs6AvSWehkYydi5qElZTaUKTw/7m618qPrjV9SGLnI81eho:6JE6AEF5q3w/7dJPVFI81b
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
HeartsOnFire.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" HeartsOnFire.exe -
Drops file in System32 directory 4 IoCs
Processes:
HeartsOnFire.exemmc.exedescription ioc process File created C:\Windows\SysWOW64\GiGu.eXe HeartsOnFire.exe File opened for modification C:\Windows\SysWOW64\GiGu.eXe HeartsOnFire.exe File created C:\Windows\SysWOW64\GiGu.eml HeartsOnFire.exe File opened for modification C:\Windows\system32\eventvwr.msc mmc.exe -
Drops file in Windows directory 2 IoCs
Processes:
HeartsOnFire.exedescription ioc process File created C:\Windows\uGiG.eXe HeartsOnFire.exe File opened for modification C:\Windows\uGiG.eXe HeartsOnFire.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3584 2364 WerFault.exe HeartsOnFire.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
HeartsOnFire.exetaskmgr.exepid process 2364 HeartsOnFire.exe 2364 HeartsOnFire.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 39 IoCs
Processes:
taskmgr.exemmc.exedescription pid process Token: SeDebugPrivilege 3492 taskmgr.exe Token: SeSystemProfilePrivilege 3492 taskmgr.exe Token: SeCreateGlobalPrivilege 3492 taskmgr.exe Token: 33 3492 taskmgr.exe Token: SeIncBasePriorityPrivilege 3492 taskmgr.exe Token: SeSecurityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: 33 4592 mmc.exe Token: SeIncBasePriorityPrivilege 4592 mmc.exe Token: SeSecurityPrivilege 4592 mmc.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
Processes:
taskmgr.exepid process 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe -
Suspicious use of SendNotifyMessage 47 IoCs
Processes:
taskmgr.exepid process 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mmc.exepid process 4592 mmc.exe 4592 mmc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HeartsOnFire.exe"C:\Users\Admin\AppData\Local\Temp\HeartsOnFire.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 5162⤵
- Program crash
PID:3584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2364 -ip 23641⤵PID:1956
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3492
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\uGiG.eXeFilesize
37KB
MD50f9c5a108cc9a63092351b60abbd7bb8
SHA1ae77d80bf23f920a4298e9992816bd96d8cd5900
SHA2561115c7829a5da053a0e3d2951a8dcde6dae2d31db9bc7f514d36db9475fa2bd2
SHA512db51f6f327276a7732f857220b7bc2ccbe48e0b9e7a3cc6ffbdc197bef9976b184babebcc2a45b2e9301a7e7d9fd29a818d40a3b4cc5e0cf8b6f646770772e1b
-
memory/2364-0-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2364-5-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2364-8-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3492-19-0x0000028D71D60000-0x0000028D71D61000-memory.dmpFilesize
4KB
-
memory/3492-9-0x0000028D71D60000-0x0000028D71D61000-memory.dmpFilesize
4KB
-
memory/3492-15-0x0000028D71D60000-0x0000028D71D61000-memory.dmpFilesize
4KB
-
memory/3492-16-0x0000028D71D60000-0x0000028D71D61000-memory.dmpFilesize
4KB
-
memory/3492-17-0x0000028D71D60000-0x0000028D71D61000-memory.dmpFilesize
4KB
-
memory/3492-18-0x0000028D71D60000-0x0000028D71D61000-memory.dmpFilesize
4KB
-
memory/3492-10-0x0000028D71D60000-0x0000028D71D61000-memory.dmpFilesize
4KB
-
memory/3492-20-0x0000028D71D60000-0x0000028D71D61000-memory.dmpFilesize
4KB
-
memory/3492-21-0x0000028D71D60000-0x0000028D71D61000-memory.dmpFilesize
4KB
-
memory/3492-11-0x0000028D71D60000-0x0000028D71D61000-memory.dmpFilesize
4KB
-
memory/4592-23-0x00007FF98E080000-0x00007FF98EB41000-memory.dmpFilesize
10.8MB
-
memory/4592-24-0x0000000004820000-0x0000000004830000-memory.dmpFilesize
64KB
-
memory/4592-25-0x0000000004820000-0x0000000004830000-memory.dmpFilesize
64KB
-
memory/4592-26-0x0000000004820000-0x0000000004830000-memory.dmpFilesize
64KB
-
memory/4592-27-0x0000000004820000-0x0000000004830000-memory.dmpFilesize
64KB
-
memory/4592-28-0x00007FF45EB00000-0x00007FF45EB10000-memory.dmpFilesize
64KB
-
memory/4592-29-0x0000000004820000-0x0000000004830000-memory.dmpFilesize
64KB