Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe
Resource
win7-20240221-en
General
-
Target
5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe
-
Size
787KB
-
MD5
1ec0a138b86ce5bd3a0e0c8d5d069f19
-
SHA1
42ef67d99a25736dc08b8e043e8e6734f57cf29c
-
SHA256
5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702
-
SHA512
96041ae277acd76ac65a90c657078ec97ec357f80b40f61ebbc142bb4669f705d246e424f1b3d2108da80abb05959e03aa075d512cfe8a6911b964701c095bb2
-
SSDEEP
12288:qPUYOEXna6yhByZ+3RC7DgZEbPzJSVHZne+Mlcv:LYnanhEZORYTrFSPZM2
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/1216-6-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/1216-8-0x0000000001F70000-0x0000000001FA2000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation 5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe -
Executes dropped EXE 1 IoCs
pid Process 1216 5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702mgr.exe -
Loads dropped DLL 1 IoCs
pid Process 1216 5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702mgr.exe -
resource yara_rule behavioral2/memory/1216-6-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 4788 1216 WerFault.exe 94 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4632 5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe 4632 5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4632 wrote to memory of 1216 4632 5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe 94 PID 4632 wrote to memory of 1216 4632 5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe 94 PID 4632 wrote to memory of 1216 4632 5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe"C:\Users\Admin\AppData\Local\Temp\5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702mgr.exeC:\Users\Admin\AppData\Local\Temp\5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702mgr.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 5163⤵
- Program crash
PID:4788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1216 -ip 12161⤵PID:1804
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2228,i,17475224967547320003,13667387715861799238,262144 --variations-seed-version /prefetch:81⤵PID:5040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702mgr.exe
Filesize157KB
MD52ad7467eeceedd64b8bd4f6e04c3cd49
SHA1d6c5d9878dc49ae9b531d61283609e207154a921
SHA2562aab17b2f18dfb70cd737b27b1a438ad8878889070a6e025b3684483054f60c9
SHA5127a647d4a8de90d11cd5afb82ace8354869af0893f28afcf9491d1d4de421315d9a394a5d3462d88c0eff6c5a7a4ed41897d8d0498b59b4b7428ddbb61786be2a
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219