Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe
Resource
win10-20231129-en
General
-
Target
cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe
-
Size
6.9MB
-
MD5
82e79a3551443cf5e201a7ebe9ee0a3e
-
SHA1
e7fb6563cf07ba276a34e3a97272bb9e77da3c58
-
SHA256
cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2
-
SHA512
7ea45b1b5224ca4cbd28d6cfe1d540364c3e1d56412512137d3c6a268533d83e4bc5836c14dcb6928489410ad0823f7ba8ea011d3a70b138bf313a2f3e6d4518
-
SSDEEP
196608:QxOlhkHxfDumIwWJfU1IzKkGjAqiuGIqOg9zj:TjkHxfKTnJjzKkRtF9zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 5012 wmaconvert.exe 2684 wmaconvert.exe -
Loads dropped DLL 3 IoCs
pid Process 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 45.155.250.90 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PI9BS.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-5L05R.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-C45E9.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-JO80S.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-DN4JM.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-237A0.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-6RD7E.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-N60K5.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PH7LS.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-U0LUJ.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-D1TGO.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-3MF34.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-C62HK.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PNIO4.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-KR4K7.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\is-7D0VA.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-8EKEI.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-G0L4I.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\plugins\internal\is-CMD80.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\plugins\internal\is-GF0MU.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-1LS5M.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-G69F6.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\uninstall\unins000.dat cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-OG07T.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-7P396.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\uninstall\is-DN3VH.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-IIAKV.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-HNTA9.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PIPTA.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-2MIFS.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-LOH30.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-DBJV9.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-BCNNJ.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-IL0AN.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-MLPD6.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-6F1TG.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-L91I6.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-0Q5LI.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-DQ522.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-LP002.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-3GN0I.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-7SF4O.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-R58CN.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-Q9FKH.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-3C16B.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PUMKO.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-OSQOR.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-TBGC5.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\lessmsi\is-BERGC.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File opened for modification C:\Program Files (x86)\ConvertWMA\wmaconvert.exe cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-3HBB2.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-515IA.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-MM4FP.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-A4MUS.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File opened for modification C:\Program Files (x86)\ConvertWMA\uninstall\unins000.dat cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-G08S6.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-3P1RJ.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-AHKVS.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-5C49V.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-9AV5C.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-L0277.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-IIM6J.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-K6QHQ.tmp cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2400 2424 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe 74 PID 2424 wrote to memory of 2400 2424 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe 74 PID 2424 wrote to memory of 2400 2424 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe 74 PID 2400 wrote to memory of 804 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 75 PID 2400 wrote to memory of 804 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 75 PID 2400 wrote to memory of 804 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 75 PID 2400 wrote to memory of 5012 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 76 PID 2400 wrote to memory of 5012 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 76 PID 2400 wrote to memory of 5012 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 76 PID 2400 wrote to memory of 3892 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 80 PID 2400 wrote to memory of 3892 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 80 PID 2400 wrote to memory of 3892 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 80 PID 2400 wrote to memory of 2684 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 79 PID 2400 wrote to memory of 2684 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 79 PID 2400 wrote to memory of 2684 2400 cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp 79 PID 3892 wrote to memory of 3568 3892 net.exe 81 PID 3892 wrote to memory of 3568 3892 net.exe 81 PID 3892 wrote to memory of 3568 3892 net.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe"C:\Users\Admin\AppData\Local\Temp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\is-NT5A7.tmp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp"C:\Users\Admin\AppData\Local\Temp\is-NT5A7.tmp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp" /SL5="$50212,6950053,68096,C:\Users\Admin\AppData\Local\Temp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:804
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
PID:5012
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
PID:2684
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:3568
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
564KB
MD595b6b8ccc5cc268cdaf543d7f54e1c68
SHA10d06391c8175ca1c7a892a9394b52c50876d5450
SHA256ca344e18ed8f3b4ee239df195b04c49d8578ade8676cab0564dfce9168137c9e
SHA51243c691916d8f5404ed08ee0daa7a1aca9afbe9a5d663fc056bf7c76fb9ee63b1d205db06784e3abb084e3fbc57a1a3afaff410885fb32d2c9caf401ecde119af
-
Filesize
560KB
MD5d4bb71fb20b1d88dde7aaaa34124f54c
SHA137868a26d5497b0c8d9ebedaebcc5e193824198f
SHA256e2593c3e318afbc89c571042d688909b80f96ed62eb51a94f59298d6381749bf
SHA512c29662ba7dba2b07836872f9cf051df93338bebc09e0275f84a7affe32a686529d02b318f28a18581384c0ec7c5fbf26602cea91b5f74593ac962f21c6e0a54a
-
Filesize
364KB
MD5012aa20413d3e47ba1b8c1d034e14f03
SHA1f8fdc1fa8e570d943f5d5002f62c850e7a957c58
SHA2569ed66bcceb0a96736e9465c56da3b7cdd21e3780a66889070fb326aa2e9c20c4
SHA51262d866cb49ea805960df426b57013c5a9273a28ea2a6a41b4cf929db037f43be355eaa95ae16300f8c376d5304645a7c72ade66114b89bbd05b252a0fe583af8
-
C:\Users\Admin\AppData\Local\Temp\is-NT5A7.tmp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp
Filesize95KB
MD5bb9dfdbcd3afabe543a56ba40bdccca0
SHA1290d7cccb02aa51a8fd90e11634efaa2b3ffdc1a
SHA2566c9df259fd54eb0d58af51e1b51ec92e92945668fb5145444042afaebb43dd0f
SHA51207d96c03836a78ae591668f3e33353dde30949d24c2d782d5a834f9ac7f5d74bcecbfe7e6b00e713a3499e002bf30c323a83ad430d8f203b3e74beabd8316a8a
-
C:\Users\Admin\AppData\Local\Temp\is-NT5A7.tmp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp
Filesize92KB
MD564c54913ec7cf33c42d3a466c9186e94
SHA1b1a80174afe63f050b81eb6050e0bf49b18dd1fb
SHA256340040f9fa8f9866233e5b9375d62a606b546b2b83bb4caea27126099c3938cc
SHA512c317cf5303a6c6d6a066ec1aed70e1ea83d5f55b669eda0c8d6bb5ea77e98c65223ae391abb0214df891f874a0a1229c8edf7463a17a31bf1524a9f521b3e095
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303