Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:00
Static task
static1
Behavioral task
behavioral1
Sample
7508d3a74c0efc2412cfd5d0cdcaa4e9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7508d3a74c0efc2412cfd5d0cdcaa4e9.exe
Resource
win10v2004-20231215-en
General
-
Target
7508d3a74c0efc2412cfd5d0cdcaa4e9.exe
-
Size
2.2MB
-
MD5
7508d3a74c0efc2412cfd5d0cdcaa4e9
-
SHA1
9d640a81ef79533c1a1f9e8089a641aadf109ce5
-
SHA256
3fb0571dcf45adfcdf2c6807fe7518b88b8d5d7989643c338328e8cabcff4afc
-
SHA512
69e4dc2bf93dcaf0fadd6e455a6f3f27e133b8e53870f051a05f44959d335595f2c642112ff51f82fae2e445a69f5a1136c5d610976df0fa11df8d8ef7f9166d
-
SSDEEP
49152:Zqf+9GLccwpWfYCjRkCXDg5V70MU1JU7eza/Bh0HFUAz:ZTULcpUfY+RWTay3/k
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7508d3a74c0efc2412cfd5d0cdcaa4e9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wapp = "C:\\Arquivos de programas\\Wapp.exe" 7508d3a74c0efc2412cfd5d0cdcaa4e9.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7508d3a74c0efc2412cfd5d0cdcaa4e9.exepid process 1364 7508d3a74c0efc2412cfd5d0cdcaa4e9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
7508d3a74c0efc2412cfd5d0cdcaa4e9.exedescription pid process target process PID 1364 wrote to memory of 2960 1364 7508d3a74c0efc2412cfd5d0cdcaa4e9.exe schtasks.exe PID 1364 wrote to memory of 2960 1364 7508d3a74c0efc2412cfd5d0cdcaa4e9.exe schtasks.exe PID 1364 wrote to memory of 2960 1364 7508d3a74c0efc2412cfd5d0cdcaa4e9.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7508d3a74c0efc2412cfd5d0cdcaa4e9.exe"C:\Users\Admin\AppData\Local\Temp\7508d3a74c0efc2412cfd5d0cdcaa4e9.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- Creates scheduled task(s)
PID:2960