Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 15:27
Static task
static1
Behavioral task
behavioral1
Sample
aadfa345719f17e5212d13a734950920N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
aadfa345719f17e5212d13a734950920N.exe
Resource
win10v2004-20240802-en
General
-
Target
aadfa345719f17e5212d13a734950920N.exe
-
Size
237KB
-
MD5
aadfa345719f17e5212d13a734950920
-
SHA1
e05cd914838c4637a1c07054b8611c51b2390aca
-
SHA256
c0062012b96d3292db68d5ce8fac1170f5c6d1034ec9c5163f60bb06381239cc
-
SHA512
7f4b1e2d927cb2e2bc853baa3867bbcceebc1badbe08990f4c6821e27ae623cd7bf262cd3ea7b2214481eaaca230e8fb33ec026807fd1ed38309001be0fb7be7
-
SSDEEP
6144:mA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:mATuTAnKGwUAWVycQqgj
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1664 4052 WerFault.exe winver.exe 1264 3624 WerFault.exe aadfa345719f17e5212d13a734950920N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
aadfa345719f17e5212d13a734950920N.exewinver.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aadfa345719f17e5212d13a734950920N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3524 Explorer.EXE Token: SeCreatePagefilePrivilege 3524 Explorer.EXE Token: SeShutdownPrivilege 3524 Explorer.EXE Token: SeCreatePagefilePrivilege 3524 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
winver.exeaadfa345719f17e5212d13a734950920N.exepid process 4052 winver.exe 3624 aadfa345719f17e5212d13a734950920N.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3524 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
aadfa345719f17e5212d13a734950920N.exewinver.exedescription pid process target process PID 3624 wrote to memory of 4052 3624 aadfa345719f17e5212d13a734950920N.exe winver.exe PID 3624 wrote to memory of 4052 3624 aadfa345719f17e5212d13a734950920N.exe winver.exe PID 3624 wrote to memory of 4052 3624 aadfa345719f17e5212d13a734950920N.exe winver.exe PID 3624 wrote to memory of 4052 3624 aadfa345719f17e5212d13a734950920N.exe winver.exe PID 4052 wrote to memory of 3524 4052 winver.exe Explorer.EXE PID 3624 wrote to memory of 3524 3624 aadfa345719f17e5212d13a734950920N.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\aadfa345719f17e5212d13a734950920N.exe"C:\Users\Admin\AppData\Local\Temp\aadfa345719f17e5212d13a734950920N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 3004⤵
- Program crash
PID:1664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 7563⤵
- Program crash
PID:1264
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:2464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4052 -ip 40521⤵PID:4736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3624 -ip 36241⤵PID:2760