Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
www.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
www.exe
-
Size
1.0MB
-
MD5
b6fded66a1bf362c4ef98883f04b53ac
-
SHA1
aaa5e105742754c5b250276e916e13ea34613560
-
SHA256
3218d9e3413de3fc262447ccddd5f9f458c82abdb96943e830dfc3ebeb1a1de5
-
SHA512
17ce4adce92925b137cf4e3cfdf8b43c705cdf949a139ad2de77fe2579debcf72c0b2d3ab43e58593d66e0167e3e02d9164953c51041006df9a2560b6e297108
-
SSDEEP
24576:lexvf1XsiJ6Y1GxCNEaDfTeLfbCFUGDBOkv95m27R7w:svf18K1ZDbefCuGDBOoXR7
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gaeqsfjr = "C:\\Users\\Admin\\AppData\\Roaming\\Gaeqsfjr.exe" www.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5996 1924 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language www.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1924 www.exe 1924 www.exe 1924 www.exe 1924 www.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1924 www.exe Token: SeDebugPrivilege 1924 www.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 5996 1924 www.exe 31 PID 1924 wrote to memory of 5996 1924 www.exe 31 PID 1924 wrote to memory of 5996 1924 www.exe 31 PID 1924 wrote to memory of 5996 1924 www.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\www.exe"C:\Users\Admin\AppData\Local\Temp\www.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 9082⤵
- Program crash
PID:5996
-