4e9da3a0ad0803a3c309714a8f72329d1887bc11013a20d2cb34273714c682ca

Analysis

max time kernel
117s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90a05e65ead68457838673b2e05cc7d0N.exe
Size 225KB
Sample240727-e3gx2sxdpk
SHA256 4e9da3a0ad0803a3c309714a8f72329d1887bc11013a20d2cb34273714c682ca
MD5 90a05e65ead68457838673b2e05cc7d0
SHA1 0d6ddc8990260629a3d6b8e18bdb57a47d995d95
SHA512 16e8fad0c8805fa0b4efb25d96c9a44565be1508bf126b35567d371cff70c3beaec704ce9e9c6c6b73ed4d84e6ff775e4b7e3a86787893a40eed04efdfb0dd91
SSDEEP 6144:OA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:OATuTAnKGwUAW3ycQqgf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2976	4948	WerFault.exe	99
4876	3008	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90a05e65ead68457838673b2e05cc7d0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winver.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3008	90a05e65ead68457838673b2e05cc7d0N.exe
3008	90a05e65ead68457838673b2e05cc7d0N.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE
Token: SeShutdownPrivilege	3428	Explorer.EXE
Token: SeCreatePagefilePrivilege	3428	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4948	winver.exe
3008	90a05e65ead68457838673b2e05cc7d0N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3428	Explorer.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 4948	3008	90a05e65ead68457838673b2e05cc7d0N.exe	99
PID 3008 wrote to memory of 4948	3008	90a05e65ead68457838673b2e05cc7d0N.exe	99
PID 3008 wrote to memory of 4948	3008	90a05e65ead68457838673b2e05cc7d0N.exe	99
PID 3008 wrote to memory of 4948	3008	90a05e65ead68457838673b2e05cc7d0N.exe	99
PID 4948 wrote to memory of 3428	4948	winver.exe	56
PID 3008 wrote to memory of 3428	3008	90a05e65ead68457838673b2e05cc7d0N.exe	56
PID 3008 wrote to memory of 2844	3008	90a05e65ead68457838673b2e05cc7d0N.exe	49

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2844

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3428
- C:\Users\Admin\AppData\Local\Temp\90a05e65ead68457838673b2e05cc7d0N.exe
  "C:\Users\Admin\AppData\Local\Temp\90a05e65ead68457838673b2e05cc7d0N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 308
      4⤵
      Program crash
      PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 964
    3⤵
    - Program crash
    PID:4876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4948 -ip 4948
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3008 -ip 3008
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2844-12-0x00000000007C0000-0x00000000007C6000-memory.dmp

Download

memory/2844-18-0x00000000007C0000-0x00000000007C6000-memory.dmp

Download

memory/3008-1-0x00000000045C0000-0x0000000004C18000-memory.dmp

Download

memory/3008-2-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Download

memory/3008-6-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3008-9-0x00000000057D0000-0x00000000061D0000-memory.dmp

Download

memory/3008-14-0x00000000057D0000-0x00000000061D0000-memory.dmp

Download

memory/3008-17-0x00000000045C0000-0x0000000004C18000-memory.dmp

Download

memory/3428-5-0x0000000001400000-0x0000000001406000-memory.dmp

Download

memory/3428-4-0x0000000001400000-0x0000000001406000-memory.dmp

Download

memory/3428-10-0x0000000001410000-0x0000000001416000-memory.dmp

Download