Analysis

  • max time kernel
    18s
  • max time network
    8s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 22:46

General

  • Target

    WPE PRO/WPE PRO.exe

  • Size

    812KB

  • MD5

    38636da4753018707fc77cd1e47ea5e2

  • SHA1

    37221eb822abf5dc9617aa2694f24ad3b40fa016

  • SHA256

    1fdf2cdd48dfc4d68dcde6ce4f0243aa1ac552da11f3312d476f3ed6b4723dfe

  • SHA512

    779ce68537c75ea7fc85fed3f745b5759d640fd449dc41a499cfcb0e0497bb790873b4d9bd71f9dd1f9ea268512dc6e36bcbf861dbb7cbc6389a63c42dcee380

  • SSDEEP

    12288:S3v6sgx8iIivBmxWb30XJe4s1lJSOCx8zmRaar5kuHer2zH/aJsICKU7:S/6tIu3Ujs1jDCx3GuDTK

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WPE PRO\WPE PRO.exe
    "C:\Users\Admin\AppData\Local\Temp\WPE PRO\WPE PRO.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3024

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3024-21-0x000000007FE40000-0x000000007FE41000-memory.dmp

          Filesize

          4KB

        • memory/3024-20-0x000000007FE40000-0x000000007FE41000-memory.dmp

          Filesize

          4KB

        • memory/3024-26-0x000000007FE30000-0x000000007FE31000-memory.dmp

          Filesize

          4KB