e5e6dda576bbe9d03c05cef4f9858a772dd7fb183d62720ad694397ec33176eb

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50a456af5652c967f961a64cf3575cea.exe
Size

212KB
MD5

50a456af5652c967f961a64cf3575cea
SHA1

4d04414c7a3aa8ed11914983b9db386a784cb286
SHA256

e5e6dda576bbe9d03c05cef4f9858a772dd7fb183d62720ad694397ec33176eb
SHA512

217b2642f9d5d8a5af818c9d1e5805ba439c8ddeef467152ed99c5d62548fe5f229713842d3c72ea417c4f9cc58baac9368995ac0f2c6bec49280c8012904504
SSDEEP

3072:13TzXu32JVDHa94mHkIu8aauuuoQOzaKZEUHCRix3qO43F/oNO:13PXu3WITV9aaE0aKZhrxm/oNO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	50a456af5652c967f961a64cf3575cea.exe

Executes dropped EXE 1 IoCs

pid	Process
3012	mwpwold.exe

Loads dropped DLL 1 IoCs

pid	Process
3012	mwpwold.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
4416	1508	WerFault.exe	88
2652	1508	WerFault.exe	88
5116	1508	WerFault.exe	88
4352	1508	WerFault.exe	88
3492	1508	WerFault.exe	88
4548	1508	WerFault.exe	88
4120	1508	WerFault.exe	88
3260	1508	WerFault.exe	88
2276	1508	WerFault.exe	88
2652	3012	WerFault.exe	128
224	3012	WerFault.exe	128
3464	3012	WerFault.exe	128
680	3012	WerFault.exe	128
4900	3012	WerFault.exe	128
3260	3012	WerFault.exe	128

Kills process with taskkill 1 IoCs

evasion

pid	Process
3464	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2988	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3012	mwpwold.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3012	mwpwold.exe
3012	mwpwold.exe
3012	mwpwold.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3012	mwpwold.exe
3012	mwpwold.exe
3012	mwpwold.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 5116	1508	50a456af5652c967f961a64cf3575cea.exe	121
PID 1508 wrote to memory of 5116	1508	50a456af5652c967f961a64cf3575cea.exe	121
PID 1508 wrote to memory of 5116	1508	50a456af5652c967f961a64cf3575cea.exe	121
PID 5116 wrote to memory of 3464	5116	cmd.exe	125
PID 5116 wrote to memory of 3464	5116	cmd.exe	125
PID 5116 wrote to memory of 3464	5116	cmd.exe	125
PID 5116 wrote to memory of 2988	5116	cmd.exe	126
PID 5116 wrote to memory of 2988	5116	cmd.exe	126
PID 5116 wrote to memory of 2988	5116	cmd.exe	126
PID 5116 wrote to memory of 3012	5116	cmd.exe	128
PID 5116 wrote to memory of 3012	5116	cmd.exe	128
PID 5116 wrote to memory of 3012	5116	cmd.exe	128

C:\Users\Admin\AppData\Local\Temp\50a456af5652c967f961a64cf3575cea.exe
"C:\Users\Admin\AppData\Local\Temp\50a456af5652c967f961a64cf3575cea.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 616
  2⤵
  - Program crash
  PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 640
  2⤵
  - Program crash
  PID:2652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 852
  2⤵
  - Program crash
  PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 860
  2⤵
  - Program crash
  PID:4352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 988
  2⤵
  - Program crash
  PID:3492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1012
  2⤵
  - Program crash
  PID:4548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1000
  2⤵
  - Program crash
  PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1040
  2⤵
  - Program crash
  PID:3260
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1508 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\50a456af5652c967f961a64cf3575cea.exe" & start C:\Users\Admin\AppData\Local\mwpwold.exe -f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 1508
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:2988
- - C:\Users\Admin\AppData\Local\mwpwold.exe
    C:\Users\Admin\AppData\Local\mwpwold.exe -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 888
      4⤵
      Program crash
      PID:2652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 880
      4⤵
      Program crash
      PID:224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 1184
      4⤵
      Program crash
      PID:3464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 1192
      4⤵
      Program crash
      PID:680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 1232
      4⤵
      Program crash
      PID:4900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 1220
      4⤵
      Program crash
      PID:3260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 160
  2⤵
  - Program crash
  PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1508 -ip 1508
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1508 -ip 1508
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1508 -ip 1508
1⤵
PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1508 -ip 1508
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1508 -ip 1508
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1508 -ip 1508
1⤵
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1508 -ip 1508
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1508 -ip 1508
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1508 -ip 1508
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3012 -ip 3012
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3012 -ip 3012
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3012 -ip 3012
1⤵
PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3012 -ip 3012
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3012 -ip 3012
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3012 -ip 3012
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mwpwold.exe

Filesize
212KB

MD5
50a456af5652c967f961a64cf3575cea

SHA1
4d04414c7a3aa8ed11914983b9db386a784cb286

SHA256
e5e6dda576bbe9d03c05cef4f9858a772dd7fb183d62720ad694397ec33176eb

SHA512
217b2642f9d5d8a5af818c9d1e5805ba439c8ddeef467152ed99c5d62548fe5f229713842d3c72ea417c4f9cc58baac9368995ac0f2c6bec49280c8012904504

Download Submit
memory/1508-1-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/1508-0-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/1508-2-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1508-3-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/1508-4-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/1508-5-0x0000000000D80000-0x0000000000D82000-memory.dmp

Filesize
8KB

Download
memory/1508-7-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/1508-10-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-18-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-26-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-19-0x0000000000490000-0x0000000000492000-memory.dmp

Filesize
8KB

Download
memory/3012-14-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-21-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-23-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-24-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-17-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-28-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-30-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-33-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-35-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-37-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-39-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download
memory/3012-41-0x0000000001000000-0x0000000001148000-memory.dmp

Filesize
1.3MB

Download