Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 15:00
Behavioral task
behavioral1
Sample
91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe
-
Size
112KB
-
MD5
afa99e324970b92cee27cbc051a74610
-
SHA1
31a8a7b985d54330fd5151dd4a670323d5b3f93a
-
SHA256
91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604
-
SHA512
03c3ec41c337ad54a66193294e48f721ba8e8a70076fdba8e251476cda216ca19de78abe22c5d1c7bc969b9e0924819c84599fb0b89de403e83acf2c83ff5946
-
SSDEEP
768:pKEBUUC151Npquv3Rn4KE7pRnbcuyD7UYE:ooU5bLpXRxMnouy8D
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2748 WAMain.exe -
Loads dropped DLL 5 IoCs
pid Process 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
resource yara_rule behavioral1/memory/2252-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x000d00000001226d-37.dat upx behavioral1/memory/2748-43-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2252-46-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2748-48-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe Token: SeDebugPrivilege 2748 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 2748 WAMain.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2544 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 30 PID 2252 wrote to memory of 2544 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 30 PID 2252 wrote to memory of 2544 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 30 PID 2252 wrote to memory of 2544 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 30 PID 2544 wrote to memory of 596 2544 cmd.exe 32 PID 2544 wrote to memory of 596 2544 cmd.exe 32 PID 2544 wrote to memory of 596 2544 cmd.exe 32 PID 2544 wrote to memory of 596 2544 cmd.exe 32 PID 2252 wrote to memory of 2748 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 33 PID 2252 wrote to memory of 2748 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 33 PID 2252 wrote to memory of 2748 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 33 PID 2252 wrote to memory of 2748 2252 91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe"C:\Users\Admin\AppData\Local\Temp\91cef17f18a0117b0029b18908bb541f227565002f2f9623ba862984a9b1f604N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\SAONH.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:596
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD50887abe327a4eb6ceae7dbcbb0a585dd
SHA12a7f764fc5bcde8da484093af131c094681ee7b7
SHA25629cd8054dc7849d6ceb3898afa4c30c57a2db0ffd2591c0f4ad554c312eb5e34
SHA512917f18c339befdcd703d199bde9b5eeab15cf2ad4d4b5233f678fc62ad3599457d61c8ddac756b17da3c448275e697b35445a94114506fa47ff811856201be22