Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 09:34
Static task
static1
Behavioral task
behavioral1
Sample
6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe
Resource
win10v2004-20240802-en
General
-
Target
6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe
-
Size
8.2MB
-
MD5
7212283e1556c634629917b01de6f817
-
SHA1
321fd880d3ab4fadb36e9b512aed760de0f2e6bd
-
SHA256
6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9
-
SHA512
c6c688ebdec6eeee59c8b84066a3a3a18934b17d56cba5e2e8d2e7a38d099382ec9887af8024115a090405c7d3a7d9248759b75e481656d1e9a94d68f0e98da8
-
SSDEEP
98304:6nHKrVhknxx8ujLWFghGdkXC/2rF2Uf3LRBYZAIGVzArOSqeDalc6d:frmLQG2WRS8c9BDal
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe.lnk 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe -
Loads dropped DLL 1 IoCs
pid Process 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 944 220 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1356 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1356 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 220 wrote to memory of 2868 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 94 PID 220 wrote to memory of 2868 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 94 PID 220 wrote to memory of 2868 220 6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe 94 PID 2868 wrote to memory of 1356 2868 cmd.exe 96 PID 2868 wrote to memory of 1356 2868 cmd.exe 96 PID 2868 wrote to memory of 1356 2868 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe"C:\Users\Admin\AppData\Local\Temp\6c2c5d0bb0277ae084ba6053a630a951d6ffa2de524cb6b8a133f5f25d1410b9.exe"1⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\cmd.execmd.exe /c netstat -an2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 14762⤵
- Program crash
PID:944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 220 -ip 2201⤵PID:2240
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:81⤵PID:224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.4MB
MD58b6c94bbdbfb213e94a5dcb4fac28ce3
SHA1b56102ca4f03556f387f8b30e2b404efabe0cb65
SHA256982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
SHA5129d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a