f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837a

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe
Size

256KB
MD5

667419a3685b49239a11fd2a8548f410
SHA1

4a9c69e73fc19f0062a71487ac03548123f14d9b
SHA256

f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837a
SHA512

aca08a717a6bd2b8aabfdf4e7ddedf1c11de7f21581f2bc36911e294134048ceb71beabf3997ab6c5f4f3166160a1789a3ad9277106002a0ffa4121988f58bea
SSDEEP

3072:EfbA7uidA7AyemWvik8STpUpbQ47+CcfIyZ+cjstHKaGKRejorRVKWI1uaaMRc8:Vdw3Wi2T2tPPEZz8HPzRej6z0u2u8

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1924	WinDDK.exe

Loads dropped DLL 1 IoCs

pid	Process
2960	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDDK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2960	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe
1924	WinDDK.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1924	2960	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe	28
PID 2960 wrote to memory of 1924	2960	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe	28
PID 2960 wrote to memory of 1924	2960	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe	28
PID 2960 wrote to memory of 1924	2960	f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe	28

C:\Users\Admin\AppData\Local\Temp\f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe
"C:\Users\Admin\AppData\Local\Temp\f6cb821e149db8c24705a009e1238c78f65de49b0f026a1d5e49355812be837aN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960
- C:\WinDDK\WinDDK.exe
  C:\WinDDK\WinDDK.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WinDDK\tmp-0.bin

Filesize
8KB

MD5
52fe4232bda48a60278960fa801a6586

SHA1
b169df7820aa3be52a4626a4e9ad9229f12faa58

SHA256
d1d1eebbf8cebfe88c5fce3e878bf31b567efbbf003187c1b3c4da2d1f37635d

SHA512
14a034d7d9bbf907cb5de9eaf55bd4eab03fd0f66364518174ba698e91255a0867371c068d44b2c9dbb705ce9f8d3d456b7651f1d96b83cccbfe5251e624bef9

Download Submit
\WinDDK\WinDDK.exe

Filesize
256KB

MD5
ac2ab659e264b2ad2b81205aa55949f9

SHA1
b3eacb8e90844504ae4512b4fc90b207e1629546

SHA256
04fc6d28026a777fdcd1ece00b53bcdc55b120d5652b7562613b544932547a0e

SHA512
73c4060bdb4d05d2d884db28537fd98e9fd2d78f86bfacb0f3384d9a901b236f2a3e14039a268f5150dd50d461f51f384e2ac7eab7657b072f005497fc6946d9

Download Submit