Overview
overview
10Static
static
3407749c986...2N.exe
windows7-x64
7407749c986...2N.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$TEMP/windll.dll
windows7-x64
10$TEMP/windll.dll
windows10-2004-x64
10$TEMP/word....0.exe
windows7-x64
7$TEMP/word....0.exe
windows10-2004-x64
7Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$TEMP/windll.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$TEMP/windll.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$TEMP/word-repair-software-3.0.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$TEMP/word-repair-software-3.0.exe
Resource
win10v2004-20240910-en
General
-
Target
407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe
-
Size
2.6MB
-
MD5
e4bca8028198e6bfc5c93c5599b50b20
-
SHA1
0e1a342059e93a7d41035b0eaa020d8ae814c795
-
SHA256
407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292
-
SHA512
7136202fbbb67fe570e36f902dd9616b0ef67b9f785e06ac9ed135fc00c9e48ec0bdcada8b5a7b0e51896504f29e05ed06ea3169d784ca596f3b6df93105fc7f
-
SSDEEP
49152:mCO3E1DLGDOmRoZXf994bBlHYh/KURaymOdfnjxhRAZ/e1Cqk10SBj0XlHdbBZUu:eOLGasavK0/faymOdfnjxhaZfR102QVT
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2616 word-repair-software-3.0.exe 396 word-repair-software-3.0.tmp -
Loads dropped DLL 1 IoCs
pid Process 3204 407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language word-repair-software-3.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language word-repair-software-3.0.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3204 wrote to memory of 2616 3204 407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe 89 PID 3204 wrote to memory of 2616 3204 407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe 89 PID 3204 wrote to memory of 2616 3204 407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe 89 PID 2616 wrote to memory of 396 2616 word-repair-software-3.0.exe 90 PID 2616 wrote to memory of 396 2616 word-repair-software-3.0.exe 90 PID 2616 wrote to memory of 396 2616 word-repair-software-3.0.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe"C:\Users\Admin\AppData\Local\Temp\407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\word-repair-software-3.0.exe"C:\Users\Admin\AppData\Local\Temp\word-repair-software-3.0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\is-RGE6V.tmp\word-repair-software-3.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-RGE6V.tmp\word-repair-software-3.0.tmp" /SL5="$B0288,2363002,54272,C:\Users\Admin\AppData\Local\Temp\word-repair-software-3.0.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:396
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:81⤵PID:1960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD50fed0ac6b23dd0774476bf124ffaf9d4
SHA17b67a702d1ed31597fcb45b79e894f1303cb7b98
SHA256fc516517a9796d1c45dd8c883feec1aa6952d7cf713eaec9ae6069265de35964
SHA5122728923e238b5a7d3d7eb25855c1aa9c54e1db5bad3039cf4709371a25cc857e63611b8beba78c39965aedc852e4234b70b52d4e793d797ec57f979e9ab61a98
-
Filesize
72KB
MD5b13935bfa7a3e43c112bd9fa02f08f28
SHA1dec4f136057097c412f53c2ae41b80a8ad0c6810
SHA256796f7efb91904fa4105528e18f6f87e3fdab9a070dabef83e02f9ae375b2b060
SHA5121b92cde7bf74fc181b4d2602a269ef1f581b75eb67e3e46b256ddaddc153b95ee17d422a56ca04d68eafe61ab468b708f7f3691f3b47c554a67af00d49b2709a
-
Filesize
2.5MB
MD54507e7f8735f635c3a8d7e68065c84f5
SHA18ee35074ed849951ab20adaf17fe94b547052b84
SHA256ff56cd8c718acaecb7f1430126731818be51d66ab0c0e5543dd22770510b6f9c
SHA5128c3105fd3ac57281bcbdae89421cc37e7aa3e145c5ece4ad7a89a9702e721bb8780c7829b182b4c42d86ea382bda1d014d43fc0fe73a89a60f25e2e9642ec394