Analysis
-
max time kernel
119s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 07:26
Behavioral task
behavioral1
Sample
55e3880c1622dd7c5ae308653f63d2e0N.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
55e3880c1622dd7c5ae308653f63d2e0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
55e3880c1622dd7c5ae308653f63d2e0N.exe
-
Size
112KB
-
MD5
55e3880c1622dd7c5ae308653f63d2e0
-
SHA1
90c726fccf0553695b117cd13cf28ac2825127ff
-
SHA256
ed69bc0209366a99946c73661e8633dfb663d3e8c7e113eeda0f90810c7dbe1a
-
SHA512
072984ab91a93084492ae6705fb26e65b51be99e789f30e36d42743ee61bbf83324929a70f5b027dfb68ee9662b5a43b2fb1f0a59e7d155087b75d1a21756e19
-
SSDEEP
768:tKEBUUC151Npquv3Rn4KE7pRnbcuyD7UYE:MoU5bLpXRxMnouy8D
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 55e3880c1622dd7c5ae308653f63d2e0N.exe -
Executes dropped EXE 1 IoCs
pid Process 3536 WAMain.exe -
resource yara_rule behavioral2/memory/3404-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000d00000002340a-16.dat upx behavioral2/memory/3536-23-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3404-27-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3536-28-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55e3880c1622dd7c5ae308653f63d2e0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe Token: SeDebugPrivilege 3536 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3404 55e3880c1622dd7c5ae308653f63d2e0N.exe 3536 WAMain.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3404 wrote to memory of 2356 3404 55e3880c1622dd7c5ae308653f63d2e0N.exe 89 PID 3404 wrote to memory of 2356 3404 55e3880c1622dd7c5ae308653f63d2e0N.exe 89 PID 3404 wrote to memory of 2356 3404 55e3880c1622dd7c5ae308653f63d2e0N.exe 89 PID 2356 wrote to memory of 4132 2356 cmd.exe 93 PID 2356 wrote to memory of 4132 2356 cmd.exe 93 PID 2356 wrote to memory of 4132 2356 cmd.exe 93 PID 3404 wrote to memory of 3536 3404 55e3880c1622dd7c5ae308653f63d2e0N.exe 94 PID 3404 wrote to memory of 3536 3404 55e3880c1622dd7c5ae308653f63d2e0N.exe 94 PID 3404 wrote to memory of 3536 3404 55e3880c1622dd7c5ae308653f63d2e0N.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\55e3880c1622dd7c5ae308653f63d2e0N.exe"C:\Users\Admin\AppData\Local\Temp\55e3880c1622dd7c5ae308653f63d2e0N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WKOUA.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4132
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD53bee889dbce2ee1894b973cc83a9ea66
SHA1d21452ac08bad702918734da33ab15b1e8de1650
SHA256feb82f0b6651961f547fe85460450e2122cd2375f2e8f801e5d030992585464b
SHA5129582008ffc3c7d5df2804424fdbedd2978144d824d2de17075fd3834bef15111d2cd16099bd679d89350ed7b91fc38805dca0d555ef0ff0f6f12ee8300b999e0