Analysis
-
max time kernel
148s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 21:17
Behavioral task
behavioral1
Sample
4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe
-
Size
112KB
-
MD5
ce4d6cfe6aaf450cc0d42c13cdeb6a37
-
SHA1
07e3809cd3f202d68ab2d045fd8772d6c372f6e8
-
SHA256
4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037
-
SHA512
4a63119620fae23a1eddb2417b0995ab4639073e67178e74d551aad57f4d376c250f3fc64bd3da83c0e5f318034f8dd8c6ab26a9af8324d6651df24ff147c42c
-
SSDEEP
768:DKEBUUC151Npquv3Rn4KE7pRnbcuyD7UYE:WoU5bLpXRxMnouy8D
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1636 WAMain.exe -
Loads dropped DLL 5 IoCs
pid Process 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe -
resource yara_rule behavioral1/memory/2412-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0010000000012015-27.dat upx behavioral1/memory/1636-42-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2412-45-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1636-46-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe Token: SeDebugPrivilege 1636 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 1636 WAMain.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1744 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 29 PID 2412 wrote to memory of 1744 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 29 PID 2412 wrote to memory of 1744 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 29 PID 2412 wrote to memory of 1744 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 29 PID 1744 wrote to memory of 2384 1744 cmd.exe 31 PID 1744 wrote to memory of 2384 1744 cmd.exe 31 PID 1744 wrote to memory of 2384 1744 cmd.exe 31 PID 1744 wrote to memory of 2384 1744 cmd.exe 31 PID 2412 wrote to memory of 1636 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 32 PID 2412 wrote to memory of 1636 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 32 PID 2412 wrote to memory of 1636 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 32 PID 2412 wrote to memory of 1636 2412 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe"C:\Users\Admin\AppData\Local\Temp\4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\QVHFJ.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2384
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD58c8d65f6b381d9c8b4ec19e19e2dfbd0
SHA1af010d4fc4db43193a56b2314887d9b19844a573
SHA25622715759dc02fa3eb1214a9a268c57e32573a9fc11d9aa62bf06afb5d058720a
SHA51221fd4113b60e54fa6fe573c76df31213b68abaf187af4a5f4479afbd4cd1a7066f648d7468bd654eb4a47bc6f65deb3b6dd50cac85e00ee1ae837ea3bad74146