Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 02:22
Behavioral task
behavioral1
Sample
b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe
Resource
win10v2004-20240426-en
General
-
Target
b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe
-
Size
624KB
-
MD5
64dbf1b0c3fcd719adf1dcd3560c19e2
-
SHA1
b0ee3b9d8a0e30471f88d3072086b7cc44e09473
-
SHA256
b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3
-
SHA512
2cb38c63e5f6be65c7ca5ffd47ac2b717e370f9f828dcd5dd5c2041feaa4ab21b886839048c1acc8ab78d78ed6549dc22d7b40e1ad9f617fb1e884a7221557d7
-
SSDEEP
12288:7tKe6Zv23YLVFhBsC8iFHSs7xPY1f6Hrhdy/Ybw/6yfZEh778Lu91/wBdj:v6Zv2ivhBVnFys7xP86Lh7uhmh8i914D
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2128-0-0x0000000000400000-0x0000000000439000-memory.dmp UPX C:\Windows\SysWOW64\concp32.exe UPX behavioral2/memory/2128-7-0x0000000000400000-0x0000000000439000-memory.dmp UPX -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1343332-8B9A-11D5-EBA1-F78EEEEEE983} b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1343332-8B9A-11D5-EBA1-F78EEEEEE983}\StubPath = "msggv32.exe" b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*" b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe -
Processes:
resource yara_rule behavioral2/memory/2128-0-0x0000000000400000-0x0000000000439000-memory.dmp upx C:\Windows\SysWOW64\concp32.exe upx behavioral2/memory/2128-7-0x0000000000400000-0x0000000000439000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe" b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe" b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe -
Drops file in System32 directory 6 IoCs
Processes:
b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exedescription ioc process File created C:\Windows\SysWOW64\msggv32.exe b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe File opened for modification C:\Windows\SysWOW64\msggv32.exe b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe File created C:\Windows\SysWOW64\concp32.exe b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe File opened for modification C:\Windows\SysWOW64\concp32.exe b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe File created C:\Windows\SysWOW64\vcl32.exe b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe File opened for modification C:\Windows\SysWOW64\vcl32.exe b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2000 2128 WerFault.exe b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe -
Modifies registry class 5 IoCs
Processes:
b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1343332-8B9A-11D5-EBA1-F78EEEEEE983} b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1343332-8B9A-11D5-EBA1-F78EEEEEE983}\InprocServer32 b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1343332-8B9A-11D5-EBA1-F78EEEEEE983}\sm = ebb5525fa3bcf9422c8ff945977d6af9 b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1343332-8B9A-11D5-EBA1-F78EEEEEE983}\ax = 7ee23fe97e0f1861cd925b50c5076eb5 b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*" b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exepid process 2128 b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe"C:\Users\Admin\AppData\Local\Temp\b862e094e25950285d798c0bfcb9c587b584bb97355b23161bff6b73c0c801e3.exe"1⤵
- Modifies Installed Components in the registry
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 7522⤵
- Program crash
PID:2000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2128 -ip 21281⤵PID:4816
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\concp32.exeFilesize
634KB
MD518c9e43da0de956ba20d9dafd0f36c00
SHA1c1cb541e148574ff6df52406f6bb58a8aad6c814
SHA2569864c27fa8c3fcf8eca69c86a27eabaa20439723b4477aadb54916596c279af5
SHA5126d88bbacde8f9f8367ff8b6a8c24c7386b6731ea868d04500bb07a4ce0768aabb46853e9cf65fc98b106d24944808b1ecc368012e631b428d560a9227fb75bb9
-
memory/2128-0-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2128-7-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB