Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 19:32
Static task
static1
Behavioral task
behavioral1
Sample
2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe
Resource
win10v2004-20240802-en
General
-
Target
2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe
-
Size
225KB
-
MD5
8f3fe8cb9acbb5f5b12ca662be00c3a6
-
SHA1
1081eea9f1c45b8d7848393bdfa9774b217a4c02
-
SHA256
2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de
-
SHA512
9c4ea39a825f5b828aab00fa238698040fb3fbae7cffbbf4a98cfc8f9f6870c8008d32076028bd90dd0ca755bc49081734144c50162e6a85dfbaadceac1a5848
-
SSDEEP
6144:DA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:DATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\F462F059 = "C:\\Users\\Admin\\AppData\\Roaming\\F462F059\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exewinver.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
winver.exepid process 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe 2804 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2804 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exewinver.exedescription pid process target process PID 1496 wrote to memory of 2804 1496 2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe winver.exe PID 1496 wrote to memory of 2804 1496 2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe winver.exe PID 1496 wrote to memory of 2804 1496 2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe winver.exe PID 1496 wrote to memory of 2804 1496 2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe winver.exe PID 1496 wrote to memory of 2804 1496 2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe winver.exe PID 2804 wrote to memory of 1304 2804 winver.exe Explorer.EXE PID 2804 wrote to memory of 1184 2804 winver.exe taskhost.exe PID 2804 wrote to memory of 1240 2804 winver.exe Dwm.exe PID 2804 wrote to memory of 1304 2804 winver.exe Explorer.EXE PID 2804 wrote to memory of 1628 2804 winver.exe DllHost.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1184
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1240
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe"C:\Users\Admin\AppData\Local\Temp\2563d4475ae116dd669ea697004aa2051307cdae487cdeb4f4f752a0401de1de.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2804
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1628