Analysis
-
max time kernel
118s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-08-2024 12:44
Static task
static1
Behavioral task
behavioral1
Sample
fe1159f778e017eb0fd58dc346b8fca0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
fe1159f778e017eb0fd58dc346b8fca0N.exe
Resource
win10v2004-20240802-en
General
-
Target
fe1159f778e017eb0fd58dc346b8fca0N.exe
-
Size
225KB
-
MD5
fe1159f778e017eb0fd58dc346b8fca0
-
SHA1
ba16dfda865bd95dbeede4f0490725ceca1f81c3
-
SHA256
2151b8fd8ee17022eed747e1f46d43861579fe73ba3a51ccec33f5e5d4f45540
-
SHA512
893457bcf3ec00e6dea2f1c6609d26bfce619f45962c36ed83967c8e45b1230a45b3ee24775e2e0e2885a6b009015b0edbe1c61b3d5a332dba4feb95fad5795a
-
SSDEEP
6144:lA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:lATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4640 4824 WerFault.exe winver.exe 1668 3240 WerFault.exe fe1159f778e017eb0fd58dc346b8fca0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fe1159f778e017eb0fd58dc346b8fca0N.exewinver.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe1159f778e017eb0fd58dc346b8fca0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fe1159f778e017eb0fd58dc346b8fca0N.exepid process 3240 fe1159f778e017eb0fd58dc346b8fca0N.exe 3240 fe1159f778e017eb0fd58dc346b8fca0N.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3504 Explorer.EXE Token: SeCreatePagefilePrivilege 3504 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
fe1159f778e017eb0fd58dc346b8fca0N.exepid process 3240 fe1159f778e017eb0fd58dc346b8fca0N.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3504 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fe1159f778e017eb0fd58dc346b8fca0N.exedescription pid process target process PID 3240 wrote to memory of 4824 3240 fe1159f778e017eb0fd58dc346b8fca0N.exe winver.exe PID 3240 wrote to memory of 4824 3240 fe1159f778e017eb0fd58dc346b8fca0N.exe winver.exe PID 3240 wrote to memory of 4824 3240 fe1159f778e017eb0fd58dc346b8fca0N.exe winver.exe PID 3240 wrote to memory of 4824 3240 fe1159f778e017eb0fd58dc346b8fca0N.exe winver.exe PID 3240 wrote to memory of 3504 3240 fe1159f778e017eb0fd58dc346b8fca0N.exe Explorer.EXE PID 3240 wrote to memory of 2808 3240 fe1159f778e017eb0fd58dc346b8fca0N.exe sihost.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2808
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\fe1159f778e017eb0fd58dc346b8fca0N.exe"C:\Users\Admin\AppData\Local\Temp\fe1159f778e017eb0fd58dc346b8fca0N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 3004⤵
- Program crash
PID:4640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 9203⤵
- Program crash
PID:1668
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:4280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4824 -ip 48241⤵PID:4264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3240 -ip 32401⤵PID:1968