990654b457f620bb23346bedaa65e23506df73a3eef07a20c86da0ffa935f119

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2024 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fd08972d1086bcdf9058d4016f3b893.exe
Size

267KB
MD5

3fd08972d1086bcdf9058d4016f3b893
SHA1

69876e158f48a9c11b940191be1d9c07c09542cd
SHA256

990654b457f620bb23346bedaa65e23506df73a3eef07a20c86da0ffa935f119
SHA512

eb08376813f7e778b5bfa9ceabfcd216280578d3fdc0ea560d1286a66612e3170964a8c6d845fed14fb659099b61a3defa2eef623eea88c0fca1082f6de6b6ec
SSDEEP

6144:0Y1/PKKZeHP6tqsHbD1NhtJn0K2cecZW5q1inxEHUU+5jTHywCTi+:JP1eAhHbvh7n+BK0/dDywCT1

Score

8^/10

evasion

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\sistem.dll	3fd08972d1086bcdf9058d4016f3b893.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4340	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	3fd08972d1086bcdf9058d4016f3b893.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4460	3808	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3808	3fd08972d1086bcdf9058d4016f3b893.exe
3808	3fd08972d1086bcdf9058d4016f3b893.exe
3808	3fd08972d1086bcdf9058d4016f3b893.exe
3808	3fd08972d1086bcdf9058d4016f3b893.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3808	3fd08972d1086bcdf9058d4016f3b893.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 4340	3808	3fd08972d1086bcdf9058d4016f3b893.exe	94
PID 3808 wrote to memory of 4340	3808	3fd08972d1086bcdf9058d4016f3b893.exe	94
PID 3808 wrote to memory of 4340	3808	3fd08972d1086bcdf9058d4016f3b893.exe	94

C:\Users\Admin\AppData\Local\Temp\3fd08972d1086bcdf9058d4016f3b893.exe
"C:\Users\Admin\AppData\Local\Temp\3fd08972d1086bcdf9058d4016f3b893.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 220
  2⤵
  - Program crash
  PID:4460
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3fd08972d1086bcdf9058d4016f3b893.exe" Msnnmsg ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3808 -ip 3808
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3808-0-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/3808-3-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/3808-5-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download