Analysis
-
max time kernel
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 05:20
Behavioral task
behavioral1
Sample
9E7DE6D79CCC935FA7C1B629155CA2EF.exe
Resource
win7-20231129-en
General
-
Target
9E7DE6D79CCC935FA7C1B629155CA2EF.exe
-
Size
203KB
-
MD5
9e7de6d79ccc935fa7c1b629155ca2ef
-
SHA1
09e1a1d16d81e0c7213cd2664bc47e5ce69165ed
-
SHA256
52bed4d9c0fdb81bdc4abfd46b47b8f8fa2dcdd570fcdc94f300f087c8b3aa65
-
SHA512
58f320b34ee14c21fb69e25afab572a3c91d8f78817c365b49d35b969d5b95cf4298d34a9a437b7e2d1f3113ecdad13d63e05dbfbe50925b3c780e69664d7853
-
SSDEEP
6144:sLV6Bta6dtJmakIM5qDr7rb2Wdkytz9spP:sLV6Btpmk7mWltY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Manager = "C:\\Program Files (x86)\\WAN Manager\\wanmgr.exe" 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\WAN Manager\wanmgr.exe 9E7DE6D79CCC935FA7C1B629155CA2EF.exe File opened for modification C:\Program Files (x86)\WAN Manager\wanmgr.exe 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2704 schtasks.exe 2324 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2324 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 21 PID 3028 wrote to memory of 2324 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 21 PID 3028 wrote to memory of 2324 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 21 PID 3028 wrote to memory of 2324 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 21 PID 3028 wrote to memory of 2704 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 23 PID 3028 wrote to memory of 2704 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 23 PID 3028 wrote to memory of 2704 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 23 PID 3028 wrote to memory of 2704 3028 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 23
Processes
-
C:\Users\Admin\AppData\Local\Temp\9E7DE6D79CCC935FA7C1B629155CA2EF.exe"C:\Users\Admin\AppData\Local\Temp\9E7DE6D79CCC935FA7C1B629155CA2EF.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA0F.tmp"2⤵
- Creates scheduled task(s)
PID:2324
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpABB.tmp"2⤵
- Creates scheduled task(s)
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD551b770160f6c0ba58a36b76b46dd55a8
SHA1b95f69729b634ae959f82586d87100c571d3d1e5
SHA25684466b7f8bcab52aeda5aac066bcea6281c0068062250d0a3486bd346bcd9170
SHA512ba9f2216b4d797ae7cd3ef6d958e23df223d8ca89981600aa3de6b228e8694f672b673ea03e23c86a2797e389a869c0f8565926788d6e607a089612d325d6553
-
Filesize
1KB
MD5f3cda3e6bab1951e8d59c3eb775a14c6
SHA1434c1ec851a45c0505fd8fd28159f549e2e9adfd
SHA256067d3f5167cab2ea4e76f59386df4eaf49c6008f6451e1971274a938ad7bcf44
SHA512bc79446e4e0204c04abcacef6799aeafe7915c1a5c6bdb3573ba40370d6a6a1e2590eb6315151d12a9447970f993a17463442c5dc0ba97c58df17dddfd73d62c