Analysis
-
max time kernel
119s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2024 21:30
Behavioral task
behavioral1
Sample
4f798867596f9cd37b8e8dc73bcc57d0N.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
4f798867596f9cd37b8e8dc73bcc57d0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
4f798867596f9cd37b8e8dc73bcc57d0N.exe
-
Size
33KB
-
MD5
4f798867596f9cd37b8e8dc73bcc57d0
-
SHA1
8d23eafcbe19587ea54f13b90e45996ce51c8fb0
-
SHA256
37b32ff3c8c29630c4aaf4bb5f77fdcb399e2843929fc2cd42ce88837a34dbba
-
SHA512
6a8c58d590f7fb9418c29fd3745ef91ff73cc69dab06d3b5d33ba868f6ac2874edd42195766b0cc7322f178b1ffe72be69e43bf341db2be63b3cecfd60cdbf74
-
SSDEEP
384:A4/UCC8VcAaYRiUiiV7fhqc45u8gNrLRn4KE7p3oaNJawcudoD7US5EJN:AUUC151Npquv3Rn4KE7pRnbcuyD7UYE
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 4f798867596f9cd37b8e8dc73bcc57d0N.exe -
Executes dropped EXE 1 IoCs
pid Process 3796 WAMain.exe -
resource yara_rule behavioral2/memory/2872-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/files/0x0005000000022723-16.dat upx behavioral2/memory/3796-23-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/2872-27-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/3796-28-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f798867596f9cd37b8e8dc73bcc57d0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe Token: SeDebugPrivilege 3796 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2872 4f798867596f9cd37b8e8dc73bcc57d0N.exe 3796 WAMain.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2872 wrote to memory of 4672 2872 4f798867596f9cd37b8e8dc73bcc57d0N.exe 89 PID 2872 wrote to memory of 4672 2872 4f798867596f9cd37b8e8dc73bcc57d0N.exe 89 PID 2872 wrote to memory of 4672 2872 4f798867596f9cd37b8e8dc73bcc57d0N.exe 89 PID 4672 wrote to memory of 4500 4672 cmd.exe 92 PID 4672 wrote to memory of 4500 4672 cmd.exe 92 PID 4672 wrote to memory of 4500 4672 cmd.exe 92 PID 2872 wrote to memory of 3796 2872 4f798867596f9cd37b8e8dc73bcc57d0N.exe 93 PID 2872 wrote to memory of 3796 2872 4f798867596f9cd37b8e8dc73bcc57d0N.exe 93 PID 2872 wrote to memory of 3796 2872 4f798867596f9cd37b8e8dc73bcc57d0N.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f798867596f9cd37b8e8dc73bcc57d0N.exe"C:\Users\Admin\AppData\Local\Temp\4f798867596f9cd37b8e8dc73bcc57d0N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\COPKI.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4500
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
33KB
MD580be2a10cb14ffb22cf9cf0b6860cf4d
SHA1958d0b8fefa4b735aeb8bbe34ac5b0c31420c720
SHA2569cb1483e05e2cf8b577fcdca47688e20523305bfec4da3e5c08147ed6f13852d
SHA5120074a7ce56ddae8f9393a859d03258f5b36a8f7665292938fed2c36240a7bd0730e598598a3b2afcbdedb973845d711f4a92feda055a454c82e599fbb7b48dff