3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2023, 20:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f.exe
Size

194KB
MD5

d0ac2224fdca9099d141574a72f79688
SHA1

9f02ebe924e7d02426fb876a7b2fbd54e1ec1047
SHA256

3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f
SHA512

dbeddf33beab9eda7668e705ef89eb8518ab962f81f5011f52dd2ce89028bf6acb8c634c72ed221340c8c2277ad76ab4aacc45b62673b7cb876af8e7cea56da0
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOE:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f.exe

Executes dropped EXE 1 IoCs

pid	Process
3392	wmahost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\wmahost.exe	3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f.exe
File opened for modification	C:\Windows\Debug\wmahost.exe	3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmahost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wmahost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4368	3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4536	4368	3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f.exe	92
PID 4368 wrote to memory of 4536	4368	3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f.exe	92
PID 4368 wrote to memory of 4536	4368	3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f.exe	92

C:\Users\Admin\AppData\Local\Temp\3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f.exe
"C:\Users\Admin\AppData\Local\Temp\3f3c744e29498ddc8586595a7751b4a04406da2a5dd964756aeb1c5c37df0f4f.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3F3C74~1.EXE > nul
  2⤵
  PID:4536

C:\Windows\Debug\wmahost.exe
C:\Windows\Debug\wmahost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\wmahost.exe

Filesize
194KB

MD5
b0880187568cd2b6764cf894a88354dc

SHA1
46233e364e79f6ac87b59667b104bdf589c4932e

SHA256
efc9f3b353a57fc676a563bc30ad7086959868074b498b80302074c73ab627fe

SHA512
449137bf776622fe5d6f18f38a0103dc868637138db046bc8c49f02182e8382969f443ad2d6d7f8e25a9c68b22ee3b841d20e0e9fd6dfe2ad7323a3b00b4215c

Download Submit
C:\Windows\debug\wmahost.exe

Filesize
194KB

MD5
b0880187568cd2b6764cf894a88354dc

SHA1
46233e364e79f6ac87b59667b104bdf589c4932e

SHA256
efc9f3b353a57fc676a563bc30ad7086959868074b498b80302074c73ab627fe

SHA512
449137bf776622fe5d6f18f38a0103dc868637138db046bc8c49f02182e8382969f443ad2d6d7f8e25a9c68b22ee3b841d20e0e9fd6dfe2ad7323a3b00b4215c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads