Analysis
- max time kernel
133s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe
Resource
win7-20240419-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe
- Size 4.4MB
- Sample240603-mp763sch34
- SHA256 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4
- MD5 800fcf3a35432d3a06581153c22d3493
- SHA1 28d0897ba522fd13aba6c87259ee019adbb2eaba
- SHA512 d5f4c5a4201590a73a6af702fb72a6031eecefc015cb91db78fb5a7ab160c037a7240ab1846bab1f113605c4b7154df1055036590560fbb910ffdd2cd9dd50f7
- SSDEEP 98304:1JeVusCcg53j1qLd9z/Wro8xSFDsGegFLOAkGkzdnEVomFHKnPs:/shG3Q+o8xSFYGegFLOyomFHKnPs
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 548 ffsew.exe 2840 ffsew.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: ffsew.exe File opened (read-only) \??\E: ffsew.exe File opened (read-only) \??\H: ffsew.exe File opened (read-only) \??\K: ffsew.exe File opened (read-only) \??\O: ffsew.exe File opened (read-only) \??\Q: ffsew.exe File opened (read-only) \??\G: ffsew.exe File opened (read-only) \??\R: ffsew.exe File opened (read-only) \??\T: ffsew.exe File opened (read-only) \??\W: ffsew.exe File opened (read-only) \??\X: ffsew.exe File opened (read-only) \??\Z: ffsew.exe File opened (read-only) \??\I: ffsew.exe File opened (read-only) \??\L: ffsew.exe File opened (read-only) \??\M: ffsew.exe File opened (read-only) \??\N: ffsew.exe File opened (read-only) \??\P: ffsew.exe File opened (read-only) \??\B: ffsew.exe File opened (read-only) \??\J: ffsew.exe File opened (read-only) \??\S: ffsew.exe File opened (read-only) \??\V: ffsew.exe File opened (read-only) \??\Y: ffsew.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ffsew.exe 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe File created C:\Windows\SysWOW64\ffsew.exe 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ffsew.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ffsew.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software ffsew.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft ffsew.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie ffsew.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" ffsew.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum ffsew.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 4356 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4908 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4908 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe 4908 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe 548 ffsew.exe 548 ffsew.exe 2840 ffsew.exe 2840 ffsew.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4908 wrote to memory of 2288 4908 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe 96 PID 4908 wrote to memory of 2288 4908 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe 96 PID 4908 wrote to memory of 2288 4908 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe 96 PID 548 wrote to memory of 2840 548 ffsew.exe 97 PID 548 wrote to memory of 2840 548 ffsew.exe 97 PID 548 wrote to memory of 2840 548 ffsew.exe 97 PID 2288 wrote to memory of 4356 2288 cmd.exe 99 PID 2288 wrote to memory of 4356 2288 cmd.exe 99 PID 2288 wrote to memory of 4356 2288 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe"C:\Users\Admin\AppData\Local\Temp\9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\9C24DA~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:4356
-
-
-
C:\Windows\SysWOW64\ffsew.exeC:\Windows\SysWOW64\ffsew.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\ffsew.exeC:\Windows\SysWOW64\ffsew.exe -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:81⤵PID:2004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ffsew.exe
- Size 4.4MB
- SHA256 9c24da4de476f5ee90589912d0128ca9d63edbe28648d8502cb1f3d9227dfcf4
- MD5 800fcf3a35432d3a06581153c22d3493
- SHA1 28d0897ba522fd13aba6c87259ee019adbb2eaba
- SHA512 d5f4c5a4201590a73a6af702fb72a6031eecefc015cb91db78fb5a7ab160c037a7240ab1846bab1f113605c4b7154df1055036590560fbb910ffdd2cd9dd50f7
- SSDEEP 98304:1JeVusCcg53j1qLd9z/Wro8xSFDsGegFLOAkGkzdnEVomFHKnPs:/shG3Q+o8xSFYGegFLOyomFHKnPs
- MD5 SHA1 SHA512 SSDEEP