Analysis
- max time kernel
2s - max time network
8s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/06/2024, 03:41
Errors
General
- Target 9af7915a980b3ba7a89b8e00b08cfe257ba767910d7c486ff7af085dc85a23be.exe
- Size 24.3MB
- Sample240611-d876ratejq
- SHA256 9af7915a980b3ba7a89b8e00b08cfe257ba767910d7c486ff7af085dc85a23be
Malware Config
Signatures
- Creates new service(s) 2 TTPs
- Executes dropped EXE 1 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9af7915a980b3ba7a89b8e00b08cfe257ba767910d7c486ff7af085dc85a23be.exe"C:\Users\Admin\AppData\Local\Temp\9af7915a980b3ba7a89b8e00b08cfe257ba767910d7c486ff7af085dc85a23be.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\WhetherDefinitely\app-1.0.0\Whether�Definitely.exe"C:\Users\Admin\AppData\Local\WhetherDefinitely\app-1.0.0\Whether�Definitely.exe" --squirrel-firstrun3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C sc create ClassicLandscape binPath= "C:\Program Files\Publisher Files\MpDefenderCoreService.exe" start= auto & shutdown -r -t 0 -f4⤵
-
C:\Windows\system32\sc.exesc create ClassicLandscape binPath= "C:\Program Files\Publisher Files\MpDefenderCoreService.exe" start= auto5⤵
- Launches sc.exe
-
-
C:\Windows\system32\shutdown.exeshutdown -r -t 0 -f5⤵
-
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa399f855 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RELEASES
Update.exe
WhetherDefinitely-1.0.0-full.nupkg
Whether�Definitely.exe
Whether�Definitely.exe
Whether�Definitely.exe
Whether�Definitely.exe
part1.cab
WhetherDefinitely-1.0.0-full.nupkg
ACCOUNTMANAGEMENT.lnk
memory/4532-80-0x000000001C7A0000-0x000000001C7AE000-memory.dmp
memory/4532-6-0x00007FFFF33C3000-0x00007FFFF33C5000-memory.dmp
memory/4532-78-0x000000001DE50000-0x000000001DE58000-memory.dmp
memory/4532-79-0x000000001C7D0000-0x000000001C808000-memory.dmp
memory/4532-7-0x00000000008B0000-0x0000000000A86000-memory.dmp
memory/4532-82-0x00007FFFF33C0000-0x00007FFFF3E81000-memory.dmp
memory/4532-8-0x00007FFFF33C0000-0x00007FFFF3E81000-memory.dmp
memory/4532-49-0x0000000002C50000-0x0000000002C70000-memory.dmp
memory/4664-77-0x0000026699140000-0x000002669A208000-memory.dmp
memory/4664-83-0x00000266B4740000-0x00000266B474A000-memory.dmp
memory/4664-91-0x00000266B51C0000-0x00000266B51D2000-memory.dmp