Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 23:06
Static task
static1
Behavioral task
behavioral1
Sample
fce74f91a0846a362dd1599f636afee0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fce74f91a0846a362dd1599f636afee0N.exe
Resource
win10v2004-20240802-en
General
-
Target
fce74f91a0846a362dd1599f636afee0N.exe
-
Size
225KB
-
MD5
fce74f91a0846a362dd1599f636afee0
-
SHA1
8bd28c0e494247c72876873034fb149a12c5ff46
-
SHA256
d8bf2b7e73ffdf282b9cbcdcc762ff615945fa90818d7815c8b34d4b59756449
-
SHA512
7d7c5f34b52dcc1044e97dc5035d0bd83a93fe28b33d685c6eee58bb95bd4527265ec1761940e9cd5f09601cb32121c82a5d2702b71901dd040829a9af2b0337
-
SSDEEP
6144:5A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:5ATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\63440937 = "C:\\Users\\Admin\\AppData\\Roaming\\63440937\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fce74f91a0846a362dd1599f636afee0N.exewinver.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fce74f91a0846a362dd1599f636afee0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 43 IoCs
Processes:
winver.exepid process 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe 2816 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2816 winver.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
fce74f91a0846a362dd1599f636afee0N.exewinver.exedescription pid process target process PID 1932 wrote to memory of 2816 1932 fce74f91a0846a362dd1599f636afee0N.exe winver.exe PID 1932 wrote to memory of 2816 1932 fce74f91a0846a362dd1599f636afee0N.exe winver.exe PID 1932 wrote to memory of 2816 1932 fce74f91a0846a362dd1599f636afee0N.exe winver.exe PID 1932 wrote to memory of 2816 1932 fce74f91a0846a362dd1599f636afee0N.exe winver.exe PID 1932 wrote to memory of 2816 1932 fce74f91a0846a362dd1599f636afee0N.exe winver.exe PID 2816 wrote to memory of 1200 2816 winver.exe Explorer.EXE PID 2816 wrote to memory of 1104 2816 winver.exe taskhost.exe PID 2816 wrote to memory of 1176 2816 winver.exe Dwm.exe PID 2816 wrote to memory of 1200 2816 winver.exe Explorer.EXE PID 2816 wrote to memory of 1196 2816 winver.exe DllHost.exe PID 2816 wrote to memory of 1932 2816 winver.exe fce74f91a0846a362dd1599f636afee0N.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\fce74f91a0846a362dd1599f636afee0N.exe"C:\Users\Admin\AppData\Local\Temp\fce74f91a0846a362dd1599f636afee0N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2816
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1196