Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
07/01/2024, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
48f2a4b8e50fe007107070c7ac20c756.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
48f2a4b8e50fe007107070c7ac20c756.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 48f2a4b8e50fe007107070c7ac20c756.exe
- Size 957KB
- Sample240107-pderhaehh4
- SHA256 652e8d180660dd2ad8bc361fdbc6e51f5e4009d459522a8e1019f3225ae03ea8
- MD5 48f2a4b8e50fe007107070c7ac20c756
- SHA1 b8a9b37ccd21d1831cb5c2164a42839fd4426ed1
- SHA512 6510e0cb0ab01f0216dca96cd63b79e3333a8ed3cb24b5d39a87f618eddf82e31367fa11edd3ea57bb35d2681f513d948f079c59c7347b3f3750229e123ee388
- SSDEEP 24576:H0dOIJ6A8QCmZdf9FOFhyNO3ZAkin24/0uS66V:H0d50A8QzGHXinbtqV
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4308 netsh.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SymantecFilterCheck = "C:\\Windows\\system32\\Brisa.exe" 48f2a4b8e50fe007107070c7ac20c756.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\MEGATRON.ini 48f2a4b8e50fe007107070c7ac20c756.exe File opened for modification C:\Windows\SysWOW64\MEGATRON.ini 48f2a4b8e50fe007107070c7ac20c756.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ponto.DLL 48f2a4b8e50fe007107070c7ac20c756.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 1472 4252 WerFault.exe 14 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\TypedURLs 48f2a4b8e50fe007107070c7ac20c756.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4252 48f2a4b8e50fe007107070c7ac20c756.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4252 48f2a4b8e50fe007107070c7ac20c756.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4252 48f2a4b8e50fe007107070c7ac20c756.exe 4252 48f2a4b8e50fe007107070c7ac20c756.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4252 wrote to memory of 4308 4252 48f2a4b8e50fe007107070c7ac20c756.exe 42 PID 4252 wrote to memory of 4308 4252 48f2a4b8e50fe007107070c7ac20c756.exe 42 PID 4252 wrote to memory of 4308 4252 48f2a4b8e50fe007107070c7ac20c756.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\48f2a4b8e50fe007107070c7ac20c756.exe"C:\Users\Admin\AppData\Local\Temp\48f2a4b8e50fe007107070c7ac20c756.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 2202⤵
- Program crash
PID:1472
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram C:\windows\system32\BRISA.exe Ftp..2⤵
- Modifies Windows Firewall
PID:4308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4252 -ip 42521⤵PID:3572
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\ponto.DLL
- Size 399B
- SHA256 f37e10ca84be6e476d1164eca5b1d104f5dac890f02f5de701c61b86f19a1eae
- MD5 f0161328b321dfcba81d4516524b2781
- SHA1 c65bdb62b67f4150f94d75fa64788d8f05b13859
- SHA512 273f3bcd6cf80020ac85227184c05d4c901c07e3782e741ee5b8abb63f89171c632725de68f4b015ca902fec4268eaa1101ab8d9b7f592721e08b94a329ff672
- MD5 SHA1 SHA512