9279e81d53062a56b81d9376b968ec63de2e173c879351d41774ffad49b6f60b

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lista Dm.exe
Size

727KB
MD5

18d8da96a4c4a76ef7c61e2da610147d
SHA1

d269b8f586ceeb198dad325066fb8c7dbe0da965
SHA256

c802b9287529e0292c825534aceddf460c6175fc42cfd4a828961084a6fb63c8
SHA512

2289dca02eb510a81dde03018fab8a60f61f98450076b6ebad98011d58e320f6b2d90528ae2bc26d07a83c3052f05374a95b8ce79ca1cf744d9d6749c6369a7e
SSDEEP

12288:VXhSkl92w+wihw9G+m6J7uC+611THuwfr4bJQnz3lzpESE6iDOlsTg0:thSkl3+rhwg+m6J71n19Hn8bJW/ElOlE

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wc98pp.dll	Lista Dm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lista Dm.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Lista Dm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Lista Dm.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	Lista Dm.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32	Lista Dm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ = "C:\\Windows\\wc98pp.dll"	Lista Dm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ThreadingModel = "Apartment"	Lista Dm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp	Lista Dm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp\CLSID = "{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}"	Lista Dm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}	Lista Dm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3032	Lista Dm.exe
3032	Lista Dm.exe

C:\Users\Admin\AppData\Local\Temp\Lista Dm.exe
"C:\Users\Admin\AppData\Local\Temp\Lista Dm.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wcx7FC.tmp

Filesize
1KB

MD5
733381be8d0d7b987d0704d30e8922ab

SHA1
d2df18722c9d7dddf5b1c3bafd555b0494daa941

SHA256
55b32e545c7168d244948810d60952215a4beff4faf12da32235476f81993164

SHA512
18913b16b789f0579e745ddd57d5994479682b1f5d883f2e5f8cd71057983183e8b1e0f4e15f31e0e8fe7fe68136f2b7808be0b4d1eff5ca0505fe0e137244bd

Download Submit
memory/3032-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3032-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3032-77-0x0000000002090000-0x00000000020A1000-memory.dmp

Filesize
68KB

Download
memory/3032-96-0x0000000002090000-0x00000000020A1000-memory.dmp

Filesize
68KB

Download
memory/3032-95-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3032-99-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download