Analysis
- max time kernel
149s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
24/12/2023, 22:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
163a9272518786c4c769032c8ec47700.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
163a9272518786c4c769032c8ec47700.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 163a9272518786c4c769032c8ec47700.exe
- Size 37KB
- Sample231224-2jslrsfgf2
- SHA256 17f22bc151ec623b8f6b21e0635aa0a2ee14e13560f536e1f8dfb7eccedd98f2
- MD5 163a9272518786c4c769032c8ec47700
- SHA1 cd65e0dd2a11cca0c71be6512e28a92fdd92d683
- SHA512 b3ef7968fa932b875e83d5f5b7e47bb8439d8a896b82c2b2da3717149de1b81fb8e15e7a29e12db8eed63b541b8b09c33ab64e3b7cfcb9d34672baa0e9f5c95b
- SSDEEP 768:y0cr3xNg6Aut4bE0nvNS5ZHcWh+UNj07wbLwM6jHBB9D3xfjL2x4xC7g8QcrDu:VWpAjHIHcO+UNS8GBx3xb6x4l8Qcvu
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 163a9272518786c4c769032c8ec47700.exe - Executes dropped EXE 1 IoCs
pid Process 4644 waitfor.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\v2.0_2.0.0.0__6ceeff94d364c681\waitfor.exe:Zone.Identifier 163a9272518786c4c769032c8ec47700.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 2036 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe 4644 waitfor.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1408 wrote to memory of 968 1408 163a9272518786c4c769032c8ec47700.exe 96 PID 1408 wrote to memory of 968 1408 163a9272518786c4c769032c8ec47700.exe 96 PID 1408 wrote to memory of 968 1408 163a9272518786c4c769032c8ec47700.exe 96 PID 968 wrote to memory of 2036 968 cmd.exe 98 PID 968 wrote to memory of 2036 968 cmd.exe 98 PID 968 wrote to memory of 2036 968 cmd.exe 98 PID 968 wrote to memory of 4200 968 cmd.exe 99 PID 968 wrote to memory of 4200 968 cmd.exe 99 PID 968 wrote to memory of 4200 968 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\163a9272518786c4c769032c8ec47700.exe"C:\Users\Admin\AppData\Local\Temp\163a9272518786c4c769032c8ec47700.exe"1⤵
- Checks computer location settings
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\163a9272518786c4c769032c8ec47700.exe" & del "C:\Users\Admin\AppData\Local\Temp\163a9272518786c4c769032c8ec47700.exe" > NUL & exit2⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:2036
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setzerodata offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\163a9272518786c4c769032c8ec47700.exe"3⤵PID:4200
-
-
-
C:\ProgramData\Microsoft\v2.0_2.0.0.0__6ceeff94d364c681\waitfor.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6ceeff94d364c681\waitfor.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\v2.0_2.0.0.0__6ceeff94d364c681\waitfor.exe
- Size 37KB
- SHA256 7c5f859f75aacc8b9af444f318c86e278b31cf110587dd0404696b615b354673
- MD5 590e2c8048fec89777cf69ec06775393
- SHA1 0ce6a4911842669fb1922d789ecaf13832ec96b8
- SHA512 7ce4cd100f54152af4918513f72ed66af532ffb7721fc219465232ad27ea3feb006c17f8e32ca735646cf74b77f4843023b5c6fa8736575634c36d01a4870f6d
- SSDEEP 768:S0cr3xNg6Aut4bE0nvNS5ZHcWh+UNj07wbLwM6jHBB9D3xfjL2x4xC7g8QcrFm:1WpAjHIHcO+UNS8GBx3xb6x4l8Qchm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp4C3B.tmp
- Size 37KB
- SHA256 17f22bc151ec623b8f6b21e0635aa0a2ee14e13560f536e1f8dfb7eccedd98f2
- MD5 163a9272518786c4c769032c8ec47700
- SHA1 cd65e0dd2a11cca0c71be6512e28a92fdd92d683
- SHA512 b3ef7968fa932b875e83d5f5b7e47bb8439d8a896b82c2b2da3717149de1b81fb8e15e7a29e12db8eed63b541b8b09c33ab64e3b7cfcb9d34672baa0e9f5c95b
- SSDEEP 768:y0cr3xNg6Aut4bE0nvNS5ZHcWh+UNj07wbLwM6jHBB9D3xfjL2x4xC7g8QcrDu:VWpAjHIHcO+UNS8GBx3xb6x4l8Qcvu
- MD5 SHA1 SHA512 SSDEEP