Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 19:02
Static task
static1
Behavioral task
behavioral1
Sample
19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe
Resource
win10v2004-20240802-en
General
-
Target
19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe
-
Size
225KB
-
MD5
72c5ac4edb065d813e9e3fa19dd9469c
-
SHA1
dcfb6dfbb2e93f2be8bd1c5f8edf83b210468e43
-
SHA256
19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07
-
SHA512
7600e762703d7e917c38d622a34bbd77e814466636ecb4935ab024ea3ac56f4a8b733a17c97eedc49a2a8f495a5661fd25448208bc9bc39726d90f654d8dddd4
-
SSDEEP
6144:pA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:pATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\1E105486 = "C:\\Users\\Admin\\AppData\\Roaming\\1E105486\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exewinver.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
Processes:
winver.exepid process 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe 3056 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 3056 winver.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exewinver.exedescription pid process target process PID 2376 wrote to memory of 3056 2376 19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe winver.exe PID 2376 wrote to memory of 3056 2376 19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe winver.exe PID 2376 wrote to memory of 3056 2376 19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe winver.exe PID 2376 wrote to memory of 3056 2376 19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe winver.exe PID 2376 wrote to memory of 3056 2376 19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe winver.exe PID 3056 wrote to memory of 1196 3056 winver.exe Explorer.EXE PID 3056 wrote to memory of 1096 3056 winver.exe taskhost.exe PID 3056 wrote to memory of 1160 3056 winver.exe Dwm.exe PID 3056 wrote to memory of 1196 3056 winver.exe Explorer.EXE PID 3056 wrote to memory of 1268 3056 winver.exe DllHost.exe PID 3056 wrote to memory of 2376 3056 winver.exe 19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1096
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe"C:\Users\Admin\AppData\Local\Temp\19b793c3e17f044cb2efbb81c023eaa62e203201b0df8544d491bdd53144dc07.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3056
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1268