Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2024 01:34
Behavioral task
behavioral1
Sample
8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe
-
Size
12KB
-
MD5
c37adec75d728bf8d915cc920a72b670
-
SHA1
9224d31644d9a937b5d027496c58a6af16a8d47e
-
SHA256
8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8b
-
SHA512
3cdd9522152c1321bac4ad653629a5da5f44df77358af30b07f6c8484fc7e24f3b71153f865f0a916eedc86622fc240f291dadc73a3b1fdd7b63f5a8dd548f7e
-
SSDEEP
192:zjUWFh4fvYGIQnsA6psQt8FaNJhLkwcud2DH9VwGfctu55EJN:vKE7p3oaNJawcudoD7US5EJN
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation 8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe -
Executes dropped EXE 1 IoCs
pid Process 4932 WAMain.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
resource yara_rule behavioral2/memory/4808-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00080000000234dc-16.dat upx behavioral2/memory/4932-23-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4808-27-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4932-29-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe Token: SeDebugPrivilege 4932 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4808 8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe 4932 WAMain.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4808 wrote to memory of 5684 4808 8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe 82 PID 4808 wrote to memory of 5684 4808 8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe 82 PID 4808 wrote to memory of 5684 4808 8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe 82 PID 5684 wrote to memory of 1576 5684 cmd.exe 85 PID 5684 wrote to memory of 1576 5684 cmd.exe 85 PID 5684 wrote to memory of 1576 5684 cmd.exe 85 PID 4808 wrote to memory of 4932 4808 8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe 86 PID 4808 wrote to memory of 4932 4808 8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe 86 PID 4808 wrote to memory of 4932 4808 8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe"C:\Users\Admin\AppData\Local\Temp\8feae2e9ed67a0e7c746cb2a9942313d88266f73eb218f7b4cefd7149bc51a8bN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JJVSP.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1576
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
12KB
MD5046e27f2f298fa32c9c4f79cbacce3ea
SHA1c32846d67b37e1946f5412ecef9c93a6cf10955e
SHA25628ff6bcb641ea56ff8e79068daf7fa2995e9f85a43b8d1912cfa328e75e77040
SHA51252a18bf1448c811a5fca6e67247d685d6a24438bab9c81e6d8420a503436395f90e65406d0353fce01131ead9a775d1f504d57917b40b52e6488c5631860f573