c5e2440dd76b81b83a4e25b1b007f5005c37467f20ce5241b15a66d9a4a27a73

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WFS.exe
Size

944KB
MD5

0027ebe13c0814fdb0389d2a9182aa5a
SHA1

af8decb4d93c8b6a9c38781158b5cdcaecb5ed90
SHA256

c5e2440dd76b81b83a4e25b1b007f5005c37467f20ce5241b15a66d9a4a27a73
SHA512

413b4f6063a67e857e2e31df4ff3ca1ef6d3f0251005ffa6d47b72e2b6e3202b5952a7527df018889ec3cee3dbaca3e5e01da221ab3935a38c095428a058af48
SSDEEP

12288:WQFj6bWNNV7JeCq+R+hDNqLMQbgNgouvc5WqmiuH3w+xt4vFe:GAVgsyabgH5WXGvFe

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\Fax\Inbox\desktop.ini	WFS.exe
File opened for modification	C:\Users\Admin\Documents\Fax\Drafts\desktop.ini	WFS.exe
File opened for modification	C:\Users\Admin\Documents\Scanned Documents\desktop.ini	WFS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA	WFS.exe
File created	C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg\:3or4kl4x13tuuug3Byamue2s4b:$DATA	WFS.exe
File opened for modification	C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg\:Updt_3or4kl4x13tuuug3Byamue2s4b:$DATA	WFS.exe
File created	C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg\:Updt_3or4kl4x13tuuug3Byamue2s4b:$DATA	WFS.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1292	WFS.exe
1292	WFS.exe

C:\Users\Admin\AppData\Local\Temp\WFS.exe
"C:\Users\Admin\AppData\Local\Temp\WFS.exe"
1⤵
- Drops desktop.ini file(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg

Filesize
504KB

MD5
73d4281e46a68222934403627e5b4e19

SHA1
0f1c29cea7ea24ebb75c95114e0b0d26438e1d39

SHA256
aac4ac970ec47cd95dc7c65d7d38d29c1f948be24d5dad1d5aa21053125367c7

SHA512
bb7aad10e5accd3f5c0f6b2968973034a2f7c2523401eb234b2de0cdad2dc13f4fd58d08ece94ec06420a52b3d371ba832f8fb4741f48799703bdf32a4daf555

Download Submit