Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/08/2024, 21:17
Behavioral task
behavioral1
Sample
4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe
-
Size
112KB
-
MD5
ce4d6cfe6aaf450cc0d42c13cdeb6a37
-
SHA1
07e3809cd3f202d68ab2d045fd8772d6c372f6e8
-
SHA256
4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037
-
SHA512
4a63119620fae23a1eddb2417b0995ab4639073e67178e74d551aad57f4d376c250f3fc64bd3da83c0e5f318034f8dd8c6ab26a9af8324d6651df24ff147c42c
-
SSDEEP
768:DKEBUUC151Npquv3Rn4KE7pRnbcuyD7UYE:WoU5bLpXRxMnouy8D
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe -
Executes dropped EXE 1 IoCs
pid Process 5044 WAMain.exe -
resource yara_rule behavioral2/memory/2136-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000900000002347b-16.dat upx behavioral2/memory/5044-23-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2136-27-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5044-28-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe Token: SeDebugPrivilege 5044 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2136 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 5044 WAMain.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2136 wrote to memory of 4180 2136 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 90 PID 2136 wrote to memory of 4180 2136 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 90 PID 2136 wrote to memory of 4180 2136 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 90 PID 4180 wrote to memory of 2640 4180 cmd.exe 93 PID 4180 wrote to memory of 2640 4180 cmd.exe 93 PID 4180 wrote to memory of 2640 4180 cmd.exe 93 PID 2136 wrote to memory of 5044 2136 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 94 PID 2136 wrote to memory of 5044 2136 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 94 PID 2136 wrote to memory of 5044 2136 4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe"C:\Users\Admin\AppData\Local\Temp\4f6a5cce8bcd5b180dbd3fbb0ac346745a7e22fa82aad1592cf7bef726da7037.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CFQSN.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2640
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD533ea90f1f6c90084522898de8f97e1ea
SHA1f0dbdb2107fa3e409a53aa905676d0b0ade45497
SHA256efd12c0090b58a9c9a41b6b1d81577b08de22a42fe0391631cb10b54ca5ebeac
SHA512577b2e34fab97cc7a36cd8826314152a83eb3d8e3622e7c7a3d1cb6b105369065d2e9d39dd08c2627537027674a16c8b104f9a24b3d165314f9451af55e279e4