890ebae002fb065a1e48a8f3ab513d4b23c15a52255957a2f6b521bb79f26684

General

Target

MLWapp2.6.x64.exe
Size

4.4MB
MD5

ae7db0dd34edccce5e267361ad44cf74
SHA1

56bffac7f8e9480535ddb944d9402a316c5b12ab
SHA256

890ebae002fb065a1e48a8f3ab513d4b23c15a52255957a2f6b521bb79f26684
SHA512

01b199db7900f6c7cc1e3a57138a8b0a0df9d81556fc2599de418065a980a4839cff57d76192c17eebde5c892246e1bd9ab87830f05324025303e490e3193c85
SSDEEP

98304:0kLcjA2zqxsQ/8WGKOk1/4kyUb4p6MV7TpYQQk90JF:DkbSsXWGKOk1/4kyUo6MVaQQ/F

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	MLWapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	_unins.tmp

Executes dropped EXE 5 IoCs

pid	Process
3052	MLWapp2.6.x64.tmp
532	MLWapp.exe
3900	unins000.exe
2068	_unins.tmp
3608	unins000.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MLWapp2 = "\"C:\\Program Files\\MLWapp\\MLWapp.exe\" /autostart"	MLWapp2.6.x64.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\MLWapp\unins000.dat	MLWapp2.6.x64.tmp
File created	C:\Program Files\MLWapp\is-DJATS.tmp	MLWapp2.6.x64.tmp
File created	C:\Program Files\MLWapp\is-IERV9.tmp	MLWapp2.6.x64.tmp
File opened for modification	C:\Program Files\MLWapp\unins000.dat	MLWapp2.6.x64.tmp
File opened for modification	C:\Program Files\MLWapp\unins000.dat	_unins.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MLWapp2.6.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MLWapp2.6.x64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_unins.tmp

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	_unins.tmp

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3052	MLWapp2.6.x64.tmp
532	MLWapp.exe
532	MLWapp.exe
2068	_unins.tmp

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
532	MLWapp.exe
532	MLWapp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
532	MLWapp.exe
532	MLWapp.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3052	4548	MLWapp2.6.x64.exe	85
PID 4548 wrote to memory of 3052	4548	MLWapp2.6.x64.exe	85
PID 4548 wrote to memory of 3052	4548	MLWapp2.6.x64.exe	85
PID 3052 wrote to memory of 532	3052	MLWapp2.6.x64.tmp	88
PID 3052 wrote to memory of 532	3052	MLWapp2.6.x64.tmp	88
PID 532 wrote to memory of 3900	532	MLWapp.exe	91
PID 532 wrote to memory of 3900	532	MLWapp.exe	91
PID 532 wrote to memory of 3900	532	MLWapp.exe	91
PID 3900 wrote to memory of 2068	3900	unins000.exe	92
PID 3900 wrote to memory of 2068	3900	unins000.exe	92
PID 3900 wrote to memory of 2068	3900	unins000.exe	92
PID 532 wrote to memory of 3608	532	MLWapp.exe	94
PID 532 wrote to memory of 3608	532	MLWapp.exe	94
PID 532 wrote to memory of 3608	532	MLWapp.exe	94

C:\Users\Admin\AppData\Local\Temp\MLWapp2.6.x64.exe
"C:\Users\Admin\AppData\Local\Temp\MLWapp2.6.x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\is-OU046.tmp\MLWapp2.6.x64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OU046.tmp\MLWapp2.6.x64.tmp" /SL5="$80058,2898546,990208,C:\Users\Admin\AppData\Local\Temp\MLWapp2.6.x64.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Program Files\MLWapp\MLWapp.exe
    "C:\Program Files\MLWapp\MLWapp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Program Files\MLWapp\unins000.exe
      "C:\Program Files\MLWapp\unins000.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\iu-14D2N.tmp\_unins.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\iu-14D2N.tmp\_unins.tmp" /SECONDPHASE="C:\Program Files\MLWapp\unins000.exe" /FIRSTPHASEWND=$802C8
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:2068
  - - C:\Program Files\MLWapp\unins000.exe
      "C:\Program Files\MLWapp\unins000.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MLWapp\MLWapp.exe

Filesize
4.6MB

MD5
036a9644825a949e8afe97668474e1c6

SHA1
1e6ccf7a84e80a7839d761f1a13c1a8d07082927

SHA256
fb787808e13769d37fa63a6b82dc09ec53537dbb60d0e7f73da824bf12d961de

SHA512
aeb8dcd7b1ed57ee070629084381c1a69e43795a6af196490259da1b3f1f0c75afe525bcdca67f769a49632ac3e701351f50e5380da6bcae059859aba7116455

Download Submit
C:\Program Files\MLWapp\unins000.dat

Filesize
16KB

MD5
855b8f7a86b83305c22ff766612cf019

SHA1
898aeeeb4b5099c57295f252abd8ffd19b9112ed

SHA256
fdcdd7410769b56def8be2afe153782b03f27eced00a4d87d2c8a688ffd7d78d

SHA512
75108ab4f5e78606cc5fca059f37d060874d5a04f2eb67c1453fc664003c502be990a14c8366c197798d4219305644b64a071ed1b62fd8c5c9fb85fc79ad2bce

Download Submit
C:\Program Files\MLWapp\unins000.exe

Filesize
3.2MB

MD5
7ebbc5701d9b65747d8e0b55d75baba6

SHA1
a6d686cb408762faaa1989286e784445e72f427f

SHA256
b74d4e35b4a840ec6aa0c510faf2dd835d56b3db8d1d80b38c5abe47f34fbe84

SHA512
01ef78e139cbc1b858705077ed41f852bb39a7872017b17d5da4d1c03592dcf3b739692db6e5cc0536d4cf8ce16e193f1e401ac16be2943c484e1a5c0537816d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OU046.tmp\MLWapp2.6.x64.tmp

Filesize
3.2MB

MD5
3910bfa1391fad62f0d7a161ef178640

SHA1
85e292b4a80c2cfdaba75b273b47adab3fae6861

SHA256
21db61b8049b6a5b7d97aa1040ceb3bb31dfdbc966e08e5b119b475be8206b2d

SHA512
f4ac08bbd8b9df215d5e01eff2ff2c8471323496debe0e8a2c68b2c8bf7f6eda3fdc054630edbbe7a47809566475b9cf3480f7bec8766331d7b971a38815cd38

Download Submit
C:\Users\Public\Desktop\MLWapp.lnk

Filesize
543B

MD5
a304962fd0fcca33c06cc09b65f5c07d

SHA1
83d9ef5494a1597844736e4850419a6fced257dc

SHA256
0f5aab20b47ca64fb631eede90b2250cb78ad071ae6943043a2828263ae7a62a

SHA512
84002219ca12e4ca7824aa6efce885a08f502eafad0b3cdd5160d39e9c016c272df9fb71793c43583abfac574875d25b557b1f1326c4494928c95b4b9a4f14b4

Download Submit
memory/2068-43-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/2068-41-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/3052-25-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/3052-20-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/3052-10-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/3052-6-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/3608-44-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/3608-45-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/3900-40-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/4548-0-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/4548-26-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/4548-8-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/4548-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads