Analysis
-
max time kernel
13s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16-08-2024 20:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe
-
Size
3.0MB
-
MD5
e33c707341cd2e87ad53c731503c2474
-
SHA1
e1ea5c178ea26230f9c482ae31080033b242ed1f
-
SHA256
f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2
-
SHA512
3ac3a02e26dcc5b9e6a6f3b71854d1189f05526215396df6a7d6b6593d97c4be5eb0a5ab782c7c315a3cef9b4d3f416cc2685cd26ef0e8876716bd7763c79caf
-
SSDEEP
98304:+VODw+Hvv/7VcQaazHbFa6DA449UXFHO0WmZ:+VB2bVcEvA449UXI/
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2368 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2224 Vwxyab.exe 2568 Vwxyab.exe -
Loads dropped DLL 1 IoCs
pid Process 2224 Vwxyab.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Vwxyab.exe f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe File opened for modification C:\Windows\SysWOW64\Vwxyab.exe f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe File opened for modification C:\Windows\SysWOW64\Vwxyab.exe -auto f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vwxyab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vwxyab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2368 cmd.exe 2772 PING.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Vwxyab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Vwxyab.exe -
Modifies data under HKEY_USERS 17 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\应用程序向导生成的本地应用程序\PlaneWar\Settings Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\MainDll\ Vwxyab.exe Set value (str) \REGISTRY\USER\.DEFAULT\MainDll\ConnectGroup = "ĬÈÏ·Ö×é" Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\应用程序向导生成的本地应用程序\PlaneWar\Settings Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\应用程序向导生成的本地应用程序\PlaneWar Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\应用程序向导生成的本地应用程序\PlaneWar\Recent File List Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\应用程序向导生成的本地应用程序 Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\应用程序向导生成的本地应用程序 Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\应用程序向导生成的本地应用程序\PlaneWar Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\应用程序向导生成的本地应用程序\PlaneWar\Recent File List Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie Vwxyab.exe Set value (str) \REGISTRY\USER\.DEFAULT\MainDll\MarkTime = "2024-08-16 20:17" Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum Vwxyab.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" Vwxyab.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2772 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2256 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 2224 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2256 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2256 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 2256 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 2224 Vwxyab.exe 2224 Vwxyab.exe 2568 Vwxyab.exe 2568 Vwxyab.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2368 2256 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 30 PID 2256 wrote to memory of 2368 2256 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 30 PID 2256 wrote to memory of 2368 2256 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 30 PID 2256 wrote to memory of 2368 2256 f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe 30 PID 2224 wrote to memory of 2568 2224 Vwxyab.exe 31 PID 2224 wrote to memory of 2568 2224 Vwxyab.exe 31 PID 2224 wrote to memory of 2568 2224 Vwxyab.exe 31 PID 2224 wrote to memory of 2568 2224 Vwxyab.exe 31 PID 2368 wrote to memory of 2772 2368 cmd.exe 33 PID 2368 wrote to memory of 2772 2368 cmd.exe 33 PID 2368 wrote to memory of 2772 2368 cmd.exe 33 PID 2368 wrote to memory of 2772 2368 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe"C:\Users\Admin\AppData\Local\Temp\f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\F139F7~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2772
-
-
-
C:\Windows\SysWOW64\Vwxyab.exeC:\Windows\SysWOW64\Vwxyab.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\Vwxyab.exeC:\Windows\SysWOW64\Vwxyab.exe -acsi2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5e33c707341cd2e87ad53c731503c2474
SHA1e1ea5c178ea26230f9c482ae31080033b242ed1f
SHA256f139f74a1decc22388c1a3940cd69e327177532fb64238bc54cdc60ffa9406c2
SHA5123ac3a02e26dcc5b9e6a6f3b71854d1189f05526215396df6a7d6b6593d97c4be5eb0a5ab782c7c315a3cef9b4d3f416cc2685cd26ef0e8876716bd7763c79caf