Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21-08-2024 12:44
Static task
static1
Behavioral task
behavioral1
Sample
fe1159f778e017eb0fd58dc346b8fca0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
fe1159f778e017eb0fd58dc346b8fca0N.exe
Resource
win10v2004-20240802-en
General
-
Target
fe1159f778e017eb0fd58dc346b8fca0N.exe
-
Size
225KB
-
MD5
fe1159f778e017eb0fd58dc346b8fca0
-
SHA1
ba16dfda865bd95dbeede4f0490725ceca1f81c3
-
SHA256
2151b8fd8ee17022eed747e1f46d43861579fe73ba3a51ccec33f5e5d4f45540
-
SHA512
893457bcf3ec00e6dea2f1c6609d26bfce619f45962c36ed83967c8e45b1230a45b3ee24775e2e0e2885a6b009015b0edbe1c61b3d5a332dba4feb95fad5795a
-
SSDEEP
6144:lA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:lATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\B6B0296D = "C:\\Users\\Admin\\AppData\\Roaming\\B6B0296D\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fe1159f778e017eb0fd58dc346b8fca0N.exewinver.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe1159f778e017eb0fd58dc346b8fca0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
winver.exepid process 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe 2772 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2772 winver.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
fe1159f778e017eb0fd58dc346b8fca0N.exewinver.exedescription pid process target process PID 2452 wrote to memory of 2772 2452 fe1159f778e017eb0fd58dc346b8fca0N.exe winver.exe PID 2452 wrote to memory of 2772 2452 fe1159f778e017eb0fd58dc346b8fca0N.exe winver.exe PID 2452 wrote to memory of 2772 2452 fe1159f778e017eb0fd58dc346b8fca0N.exe winver.exe PID 2452 wrote to memory of 2772 2452 fe1159f778e017eb0fd58dc346b8fca0N.exe winver.exe PID 2452 wrote to memory of 2772 2452 fe1159f778e017eb0fd58dc346b8fca0N.exe winver.exe PID 2772 wrote to memory of 1216 2772 winver.exe Explorer.EXE PID 2772 wrote to memory of 1104 2772 winver.exe taskhost.exe PID 2772 wrote to memory of 1168 2772 winver.exe Dwm.exe PID 2772 wrote to memory of 1216 2772 winver.exe Explorer.EXE PID 2772 wrote to memory of 496 2772 winver.exe DllHost.exe PID 2772 wrote to memory of 2452 2772 winver.exe fe1159f778e017eb0fd58dc346b8fca0N.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\fe1159f778e017eb0fd58dc346b8fca0N.exe"C:\Users\Admin\AppData\Local\Temp\fe1159f778e017eb0fd58dc346b8fca0N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2772
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:496