Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 22:04
Behavioral task
behavioral1
Sample
WTLDR.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
WTLDR.exe
Resource
win10v2004-20240508-en
General
-
Target
WTLDR.exe
-
Size
31KB
-
MD5
7a94013c17dc892cea16fbae38646e43
-
SHA1
8cf54c2ac961dd5c82cb3b07c3de317847aa94bb
-
SHA256
cd35af0a0c71c382760409b7b2343c83857d89af55a0b365b72962f0f9c9a400
-
SHA512
03df47db51270ca87172620e5475ce7a99e1fa1bd61e1956e4a0b28792d145b4e30d5b0d7b0737ea3ed331cecaecde78641b4828b1b9425153b1f9ac3de6f34a
-
SSDEEP
768:jrpS7G1XB9Qzxry1vIPvQbxvKnQmIDUu0tinaj:Um6yxIQVk7j
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 4296 netsh.exe 4680 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WTLDR.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation WTLDR.exe -
Drops startup file 2 IoCs
Processes:
chrome_protect.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9300538b8eb52046b545ea0eefc265d2.exe chrome_protect.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9300538b8eb52046b545ea0eefc265d2.exe chrome_protect.exe -
Executes dropped EXE 1 IoCs
Processes:
chrome_protect.exepid process 3056 chrome_protect.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chrome_protect.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9300538b8eb52046b545ea0eefc265d2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome_protect.exe\" .." chrome_protect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9300538b8eb52046b545ea0eefc265d2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome_protect.exe\" .." chrome_protect.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WTLDR.exepid process 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe 228 WTLDR.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
WTLDR.exechrome_protect.exedescription pid process Token: SeDebugPrivilege 228 WTLDR.exe Token: SeDebugPrivilege 3056 chrome_protect.exe Token: 33 3056 chrome_protect.exe Token: SeIncBasePriorityPrivilege 3056 chrome_protect.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
WTLDR.exechrome_protect.execmd.exedescription pid process target process PID 228 wrote to memory of 3056 228 WTLDR.exe chrome_protect.exe PID 228 wrote to memory of 3056 228 WTLDR.exe chrome_protect.exe PID 228 wrote to memory of 3056 228 WTLDR.exe chrome_protect.exe PID 3056 wrote to memory of 4680 3056 chrome_protect.exe netsh.exe PID 3056 wrote to memory of 4680 3056 chrome_protect.exe netsh.exe PID 3056 wrote to memory of 4680 3056 chrome_protect.exe netsh.exe PID 3056 wrote to memory of 4296 3056 chrome_protect.exe netsh.exe PID 3056 wrote to memory of 4296 3056 chrome_protect.exe netsh.exe PID 3056 wrote to memory of 4296 3056 chrome_protect.exe netsh.exe PID 3056 wrote to memory of 4164 3056 chrome_protect.exe cmd.exe PID 3056 wrote to memory of 4164 3056 chrome_protect.exe cmd.exe PID 3056 wrote to memory of 4164 3056 chrome_protect.exe cmd.exe PID 4164 wrote to memory of 2456 4164 cmd.exe PING.EXE PID 4164 wrote to memory of 2456 4164 cmd.exe PING.EXE PID 4164 wrote to memory of 2456 4164 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\WTLDR.exe"C:\Users\Admin\AppData\Local\Temp\WTLDR.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\chrome_protect.exe"C:\Users\Admin\AppData\Local\Temp\chrome_protect.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome_protect.exe" "chrome_protect.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4680 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome_protect.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4296 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\chrome_protect.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\PING.EXEping 0 -n 24⤵
- Runs ping.exe
PID:2456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:81⤵PID:2296
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD57a94013c17dc892cea16fbae38646e43
SHA18cf54c2ac961dd5c82cb3b07c3de317847aa94bb
SHA256cd35af0a0c71c382760409b7b2343c83857d89af55a0b365b72962f0f9c9a400
SHA51203df47db51270ca87172620e5475ce7a99e1fa1bd61e1956e4a0b28792d145b4e30d5b0d7b0737ea3ed331cecaecde78641b4828b1b9425153b1f9ac3de6f34a