Analysis
-
max time kernel
118s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 15:31
Behavioral task
behavioral1
Sample
9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe
-
Size
112KB
-
MD5
62d532d7186d25312233c8e97308a850
-
SHA1
f45aaf160c8501b44ee6f60d379a8b143c00a9e5
-
SHA256
9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6
-
SHA512
54bd6d994916d9ae98ca9026bbcfb6378780f03254789860ac07c2f1db90884e96f5564f858e2c80ea76ed93278c367a8bfd0458debb157fa1fecef802328ebf
-
SSDEEP
768:EKEBUUC151Npquv3Rn4KE7pRnbcuyD7UYE:9oU5bLpXRxMnouy8D
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation 9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe -
Executes dropped EXE 1 IoCs
pid Process 4892 WAMain.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
resource yara_rule behavioral2/memory/2888-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0008000000023440-16.dat upx behavioral2/memory/4892-23-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2888-27-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4892-28-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe Token: SeDebugPrivilege 4892 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2888 9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe 4892 WAMain.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2548 2888 9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe 82 PID 2888 wrote to memory of 2548 2888 9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe 82 PID 2888 wrote to memory of 2548 2888 9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe 82 PID 2548 wrote to memory of 1460 2548 cmd.exe 85 PID 2548 wrote to memory of 1460 2548 cmd.exe 85 PID 2548 wrote to memory of 1460 2548 cmd.exe 85 PID 2888 wrote to memory of 4892 2888 9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe 86 PID 2888 wrote to memory of 4892 2888 9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe 86 PID 2888 wrote to memory of 4892 2888 9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe"C:\Users\Admin\AppData\Local\Temp\9ccec127c115150d15ba20761ddeae7170fc473f23d44958ef9dbc033f033bf6N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HRYIF.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1460
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD535d3ddaa23e8b14f3d10b27bbb735d15
SHA11df6dda3bc79c5b9da7ed393fa6aa33bfc85809f
SHA256fb6978ad0777c214f1cf2504811de39b65f3e3a43ae64957b08dff4a45080cab
SHA512869722abfff8368063008e9aa07c63d0011ea5c1d3d107f36ceda6dabde6967b34267c7ad47c549933645c7415ffff9d8b0bed82348c07f50b7fedbe44b55478