Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:05
Static task
static1
Behavioral task
behavioral1
Sample
750b7ad639421fd67495e5498e0e4829.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
750b7ad639421fd67495e5498e0e4829.exe
Resource
win10v2004-20231215-en
General
-
Target
750b7ad639421fd67495e5498e0e4829.exe
-
Size
4.4MB
-
MD5
750b7ad639421fd67495e5498e0e4829
-
SHA1
e57f4fe94fdfcdb583d8d6701c7e6046fb934275
-
SHA256
34781169be5e9033e0b780d3d281fddb0c7df9c0b5140e00f623f9342a1f2f99
-
SHA512
78353c3299ebcfccf79910d326d95a37b63ee9c5c35aa44b9009f900eec7f423039e9922ecf297928b61b6a89ce4969dab615f4abeddb7ca682ecca749a9baa2
-
SSDEEP
98304:FSORWPYPMOoAv72pgQfmsdIELPMlyJZQTE37WHlzbx:FSNsMOo24gkm0rMsTpWP
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
750b7ad639421fd67495e5498e0e4829.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wapp = "C:\\Arquivos de programas\\Wapp.exe" 750b7ad639421fd67495e5498e0e4829.exe -
Drops file in Windows directory 2 IoCs
Processes:
750b7ad639421fd67495e5498e0e4829.exedescription ioc process File created C:\Windows\Menu Iniciar\Iniciar\Wapp.exe 750b7ad639421fd67495e5498e0e4829.exe File created C:\WINDOWS\system\Logfile.txt 750b7ad639421fd67495e5498e0e4829.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
750b7ad639421fd67495e5498e0e4829.exedescription pid process target process PID 4800 wrote to memory of 1692 4800 750b7ad639421fd67495e5498e0e4829.exe schtasks.exe PID 4800 wrote to memory of 1692 4800 750b7ad639421fd67495e5498e0e4829.exe schtasks.exe PID 4800 wrote to memory of 1692 4800 750b7ad639421fd67495e5498e0e4829.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\750b7ad639421fd67495e5498e0e4829.exe"C:\Users\Admin\AppData\Local\Temp\750b7ad639421fd67495e5498e0e4829.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- Creates scheduled task(s)
PID:1692