Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
461340.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
General
-
Target
461340.exe
-
Size
415KB
-
MD5
b5bda46e3f9832d656edd1216f56b04d
-
SHA1
0bad37e244d3a50cc1b0fb2585e9e504b73224b6
-
SHA256
4e333b4b742ee952e26a136abaf144f98299f0e099b69bb2d8fa74bd145df8c5
-
SHA512
fd10b0be3e9948da0d73de25dabdd6765c48fec48a373ec0aa8c1c2b2a9b892f893410ba2ef0bee7ee1dfd481d22da8878a14cf8052f75c3a4f5371e690052e4
-
SSDEEP
6144:FROHyaR7iKZqFtj9Lbk11eHHOqamMCt8KJ6c:PKyatiwqDd0yImMeHQc
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
461340.exe461340.exewfdapply.exewfdapply.exepid process 2276 461340.exe 2276 461340.exe 4256 461340.exe 4256 461340.exe 4800 wfdapply.exe 4800 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe 2760 wfdapply.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
461340.exepid process 4256 461340.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
461340.exewfdapply.exedescription pid process target process PID 2276 wrote to memory of 4256 2276 461340.exe 461340.exe PID 2276 wrote to memory of 4256 2276 461340.exe 461340.exe PID 2276 wrote to memory of 4256 2276 461340.exe 461340.exe PID 4800 wrote to memory of 2760 4800 wfdapply.exe wfdapply.exe PID 4800 wrote to memory of 2760 4800 wfdapply.exe wfdapply.exe PID 4800 wrote to memory of 2760 4800 wfdapply.exe wfdapply.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\461340.exe"C:\Users\Admin\AppData\Local\Temp\461340.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\461340.exe"C:\Users\Admin\AppData\Local\Temp\461340.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4256
-
C:\Windows\SysWOW64\wfdapply.exe"C:\Windows\SysWOW64\wfdapply.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\wfdapply.exe"C:\Windows\SysWOW64\wfdapply.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2276-12-0x0000000002540000-0x0000000002556000-memory.dmpFilesize
88KB
-
memory/2276-5-0x0000000002560000-0x0000000002576000-memory.dmpFilesize
88KB
-
memory/2276-1-0x0000000002560000-0x0000000002576000-memory.dmpFilesize
88KB
-
memory/2276-13-0x0000000000600000-0x0000000000610000-memory.dmpFilesize
64KB
-
memory/2760-29-0x0000000000A70000-0x0000000000A86000-memory.dmpFilesize
88KB
-
memory/2760-25-0x0000000000A70000-0x0000000000A86000-memory.dmpFilesize
88KB
-
memory/4256-11-0x0000000000A60000-0x0000000000A76000-memory.dmpFilesize
88KB
-
memory/4256-7-0x0000000000A60000-0x0000000000A76000-memory.dmpFilesize
88KB
-
memory/4256-14-0x0000000000A40000-0x0000000000A56000-memory.dmpFilesize
88KB
-
memory/4256-15-0x0000000000A80000-0x0000000000A90000-memory.dmpFilesize
64KB
-
memory/4256-30-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/4256-31-0x0000000000A40000-0x0000000000A56000-memory.dmpFilesize
88KB
-
memory/4800-17-0x0000000000920000-0x0000000000936000-memory.dmpFilesize
88KB
-
memory/4800-21-0x0000000000920000-0x0000000000936000-memory.dmpFilesize
88KB
-
memory/4800-23-0x0000000000940000-0x0000000000950000-memory.dmpFilesize
64KB
-
memory/4800-22-0x0000000000900000-0x0000000000916000-memory.dmpFilesize
88KB