199566821954625ef7949f29b97f87e239182ffe295df4ce035b60f7ed7ed251

Analysis

max time kernel
0s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2023, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.6MB
Sample231206-xwh6mscb37
SHA256 199566821954625ef7949f29b97f87e239182ffe295df4ce035b60f7ed7ed251
MD5 7f10459f3d1ef5b15fe8ac3891ebfd48
SHA1 a57072c6eca8196c6fb057144634b3385f8b3eb7
SHA512 e1f60593a10a85715d51514b59b2a6aef5df36fd09fb8674d9e1821b832f5308a9c154dfbe8564d3886570d855feec9ed0e65fa43bc235a85e5c267368557d02
SSDEEP 49152:qWg8wUmZOzqiavjDUJO/WH89ctcO0ljbbQnIQGotBKqD8TJCHEGU42sn6:ZiUmZOzqiavjDUM/WH89y8bboGO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	file.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-596315103-1488671723-776734015-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	file.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	ipinfo.io
25	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	file.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	file.exe
File opened for modification	C:\Windows\System32\GroupPolicy	file.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3464	3908	WerFault.exe	20

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4688	schtasks.exe
224	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4688	3908	file.exe	90
PID 3908 wrote to memory of 4688	3908	file.exe	90
PID 3908 wrote to memory of 4688	3908	file.exe	90

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4688
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 1696
  2⤵
  - Program crash
  PID:3464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3908 -ip 3908
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OfficeTrackerNMP131.exe

Path C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
Size 1.6MB
SHA256 199566821954625ef7949f29b97f87e239182ffe295df4ce035b60f7ed7ed251
MD5 7f10459f3d1ef5b15fe8ac3891ebfd48
SHA1 a57072c6eca8196c6fb057144634b3385f8b3eb7
SHA512 e1f60593a10a85715d51514b59b2a6aef5df36fd09fb8674d9e1821b832f5308a9c154dfbe8564d3886570d855feec9ed0e65fa43bc235a85e5c267368557d02
SSDEEP 49152:qWg8wUmZOzqiavjDUJO/WH89ctcO0ljbbQnIQGotBKqD8TJCHEGU42sn6:ZiUmZOzqiavjDUM/WH89y8bboGO
MD5 SHA1 SHA512 SSDEEP

Submit Download

information.txt

Path C:\Users\Admin\AppData\Local\Temp\grandUIAjl741YUSHLE2Q\information.txt
Size 3KB
SHA256 bcd23a29e266b4238f594b6d682014417bfd70c6077d08184e454f65ca2f5426
MD5 838c3bb374bc8e96e05ffd32b16a59ed
SHA1 5b5fafa666d36ece7053a5a8710763eb3e833304
SHA512 f8d82fede22f204e69e889b7a2de49edb75fe12487a9a093f76d11ac188aba34e2d224f47032fe215e64d32622c6109a30960e3e081ab5e8498b5faf2fd64423
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads