Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04/10/2024, 15:30
General
-
Target
WhatsApp-win8.exe
-
Size
2.8MB
-
MD5
6835069cc939ed7b02c499a2574acf8c
-
SHA1
df0a3d636fdc219f9dde29dc4eb683442563aabc
-
SHA256
be140690fd1dc3adefa0d6669de51c016d009d3b1bd73313a7d8cab2665cc42c
-
SHA512
f6275d9a29eeb7289bf077b7436d97e14836355ff76002d7ae61025a8c03df440e801de742cdd412bdf8031c8d88584958ec98287bc2a4c8331a64bc1b7d89c2
-
SSDEEP
49152:jV9joZnbCvivTLM4tB5HfzhovA/nGFDll1+KAP7bCCB7VVgLZR:B9joZnbCa15VucQt+u4gLL
Malware Config
Signatures
-
Drops file in Program Files directory 40 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WhatsApp-win8.exe"C:\Users\Admin\AppData\Local\Temp\WhatsApp-win8.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\WhatsApp-win8\start.hta"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5c987932e92cc5e1d661858cb6c3ad487
SHA118a3ff5f316b8380b599e0728c114871f6bedddc
SHA25674fa8ed3bdece00a0af48a6903b726a1208cfe9d14baf70586ea9c9755c3aac8
SHA512a5bf7348db7395ae2f0cc0dea6590a50f1cff5de5b4697516171eaae7b29f6b1f2b071a362006d76a009c05fc7aaada859093976bacf48f6c7d392a899a04858
-
Filesize
31KB
MD5fcbe684b2c8944506b3b15b3dc460ac2
SHA1a752852e143f811c0693a1763472152014171793
SHA2561ad898de89db555ea34c1eaa0fa5756613012d424da3c8e3e93009f8ce885490
SHA51243bd8bc86b31164dfcf690c9e60455b1ba567cac77110956581cacfe0b76eeb119b24642bc7c38b97a26ca830b75481ada590516f7cab762af174d7040fb5295
-
Filesize
3KB
MD5f44b4a1b4b47f2107ff2a33c303f79a1
SHA194f9b5d5ab2425da5c537c0378380d2af7ba4770
SHA256d4c44a1b86a179c82cef99a19d346081f816f318c20355719ba43c3e87ff7fc7
SHA51232515c42d8cc3d1248c9f559cddd53429750ae7b3823910cef1c5cbcc73f2774bd88320c5f93f8d25bd8b337885c3528332fa7b3b645b5403a941267af7f939d
