Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
02-09-2024 04:19
Behavioral task
behavioral1
Sample
d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe
-
Size
12KB
-
MD5
845ab0dd2c50bc21f618d5abb9de9c10
-
SHA1
d208420d12419ab950696e1b1be0bef3a93b6338
-
SHA256
d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d
-
SHA512
47fd536c572158a1600ab2e5468beab6ad98b11d1401def4ae38abf864025ab147d5382a0dbf6b061cd019fe7a133e6ab0b406afbb5ff5fb2af204ff510ae0c3
-
SSDEEP
192:zjUWFh4fvYGIQnsA6psQt8FaNJhLkwcud2DH9VwGfctu55EJN:vKE7p3oaNJawcudoD7US5EJN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2876 WAMain.exe -
Loads dropped DLL 5 IoCs
pid Process 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe -
resource yara_rule behavioral1/memory/1856-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0008000000012119-41.dat upx behavioral1/memory/1856-27-0x00000000005E0000-0x00000000005EB000-memory.dmp upx behavioral1/memory/1856-44-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2876-46-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe Token: SeDebugPrivilege 2876 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 2876 WAMain.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1856 wrote to memory of 1128 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 30 PID 1856 wrote to memory of 1128 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 30 PID 1856 wrote to memory of 1128 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 30 PID 1856 wrote to memory of 1128 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 30 PID 1128 wrote to memory of 2944 1128 cmd.exe 32 PID 1128 wrote to memory of 2944 1128 cmd.exe 32 PID 1128 wrote to memory of 2944 1128 cmd.exe 32 PID 1128 wrote to memory of 2944 1128 cmd.exe 32 PID 1856 wrote to memory of 2876 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 33 PID 1856 wrote to memory of 2876 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 33 PID 1856 wrote to memory of 2876 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 33 PID 1856 wrote to memory of 2876 1856 d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe"C:\Users\Admin\AppData\Local\Temp\d374d7fe9ec8033b2b1f88e777100c6bfe7cf43ea733119425bb5b8bdc2e134d.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XNRWD.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2944
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
12KB
MD57468ebe8d5ad0f43b54feda73cc77ec7
SHA1d93702013cc0e7945de1a841a29f09d662496c22
SHA256c1490f51e2c3fefb05150e33994ebe4c33492b54743c52ab7964bda5af63be02
SHA51244376cfdc8d08693e1a0a690340232c5813327913ade36fd9d1b7e0077ae6ff31ee3c81f02b508bbbe03ea895c0ae3927a615a24d99ad2a116d1a335c3c699f4