Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 15:21
Static task
static1
Behavioral task
behavioral1
Sample
8790ca66f51b006d7326d7bf742f2e50N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8790ca66f51b006d7326d7bf742f2e50N.exe
Resource
win10v2004-20240802-en
General
-
Target
8790ca66f51b006d7326d7bf742f2e50N.exe
-
Size
225KB
-
MD5
8790ca66f51b006d7326d7bf742f2e50
-
SHA1
4848142c0019bee264ee6c92de94c66ceace71ec
-
SHA256
55113d18c872ce9d9ea3d0076cbd54ddf111a40ed61d1bcf63c94ff256ffd6fa
-
SHA512
53a02ca057ed74b02049610bf26ec655308c278b0505ba8ba59107b476c8eba567f4c91062e75975263fc74f590a0d78ab6e2c6002a8659ea681e9bf03102026
-
SSDEEP
6144:FA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:FATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\1A28F626 = "C:\\Users\\Admin\\AppData\\Roaming\\1A28F626\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
8790ca66f51b006d7326d7bf742f2e50N.exewinver.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8790ca66f51b006d7326d7bf742f2e50N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
winver.exepid process 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe 2912 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2912 winver.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
8790ca66f51b006d7326d7bf742f2e50N.exewinver.exedescription pid process target process PID 2088 wrote to memory of 2912 2088 8790ca66f51b006d7326d7bf742f2e50N.exe winver.exe PID 2088 wrote to memory of 2912 2088 8790ca66f51b006d7326d7bf742f2e50N.exe winver.exe PID 2088 wrote to memory of 2912 2088 8790ca66f51b006d7326d7bf742f2e50N.exe winver.exe PID 2088 wrote to memory of 2912 2088 8790ca66f51b006d7326d7bf742f2e50N.exe winver.exe PID 2088 wrote to memory of 2912 2088 8790ca66f51b006d7326d7bf742f2e50N.exe winver.exe PID 2912 wrote to memory of 1196 2912 winver.exe Explorer.EXE PID 2912 wrote to memory of 1080 2912 winver.exe taskhost.exe PID 2912 wrote to memory of 1168 2912 winver.exe Dwm.exe PID 2912 wrote to memory of 1196 2912 winver.exe Explorer.EXE PID 2912 wrote to memory of 2036 2912 winver.exe DllHost.exe PID 2912 wrote to memory of 2088 2912 winver.exe 8790ca66f51b006d7326d7bf742f2e50N.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1080
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\8790ca66f51b006d7326d7bf742f2e50N.exe"C:\Users\Admin\AppData\Local\Temp\8790ca66f51b006d7326d7bf742f2e50N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2912
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2036