77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658

Analysis

max time kernel
119s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe
Size

444KB
MD5

2795a515f1d8eb3f3ff92739d6229f60
SHA1

b29bc5cac4c7cd462a8080387a4ebc8cca205457
SHA256

77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658
SHA512

5ff87068a2954e2a6c19a355a5fb7c5b2aabeba970ee5df82a08888efb8ae3fe0ac17391e76998a168b8cdd8b61555cf86e934cd278525a7035a0087e16ad798
SSDEEP

6144:iAACPL1Eoqw2vJ3Ctv3SseWneFFAPxAbotJnW4SlmVeXbLR7zYXOPMT5zMHVsUpQ:zov6CuVfv/s0p8+nioBybS6wzx

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
1524	wsgsil3uto1zfw.exe
4980	ooglecrashhandler64.exe
4760	fqmsedge.exe
4216	ooglecrashhandler64.exe
3332	tification_helper.exe
4956	fqmsedge.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ooglecrashhandler64 = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\ooglecrashhandler64.exe"	ooglecrashhandler64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ooglecrashhandler64 = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\ooglecrashhandler64.exe"	wsgsil3uto1zfw.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\tification_helper.exe	fqmsedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\tification_helper.exe	fqmsedge.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\ooglecrashhandler64.exe	wsgsil3uto1zfw.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\ooglecrashhandler64.exe	wsgsil3uto1zfw.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\fqmsedge.exe	ooglecrashhandler64.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\fqmsedge.exe	ooglecrashhandler64.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\ooglecrashhandler64.exe	fqmsedge.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\ooglecrashhandler64.exe	ooglecrashhandler64.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1400	4980	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fqmsedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ooglecrashhandler64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tification_helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsgsil3uto1zfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ooglecrashhandler64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fqmsedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
2036	77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe
2036	77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe
2036	77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe
1524	wsgsil3uto1zfw.exe
1524	wsgsil3uto1zfw.exe
1524	wsgsil3uto1zfw.exe
4980	ooglecrashhandler64.exe
4980	ooglecrashhandler64.exe
4980	ooglecrashhandler64.exe
4760	fqmsedge.exe
4760	fqmsedge.exe
4760	fqmsedge.exe
4216	ooglecrashhandler64.exe
4216	ooglecrashhandler64.exe
4216	ooglecrashhandler64.exe
3332	tification_helper.exe
3332	tification_helper.exe
3332	tification_helper.exe
4956	fqmsedge.exe
4956	fqmsedge.exe
4956	fqmsedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1524	2036	77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe	85
PID 2036 wrote to memory of 1524	2036	77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe	85
PID 2036 wrote to memory of 1524	2036	77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe	85
PID 2036 wrote to memory of 2892	2036	77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe	87
PID 2036 wrote to memory of 2892	2036	77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe	87
PID 2036 wrote to memory of 2892	2036	77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe	87
PID 2892 wrote to memory of 628	2892	cmd.exe	89
PID 2892 wrote to memory of 628	2892	cmd.exe	89
PID 2892 wrote to memory of 628	2892	cmd.exe	89
PID 1524 wrote to memory of 4980	1524	wsgsil3uto1zfw.exe	90
PID 1524 wrote to memory of 4980	1524	wsgsil3uto1zfw.exe	90
PID 1524 wrote to memory of 4980	1524	wsgsil3uto1zfw.exe	90
PID 1524 wrote to memory of 8	1524	wsgsil3uto1zfw.exe	91
PID 1524 wrote to memory of 8	1524	wsgsil3uto1zfw.exe	91
PID 1524 wrote to memory of 8	1524	wsgsil3uto1zfw.exe	91
PID 8 wrote to memory of 1576	8	cmd.exe	93
PID 8 wrote to memory of 1576	8	cmd.exe	93
PID 8 wrote to memory of 1576	8	cmd.exe	93
PID 4980 wrote to memory of 4760	4980	ooglecrashhandler64.exe	94
PID 4980 wrote to memory of 4760	4980	ooglecrashhandler64.exe	94
PID 4980 wrote to memory of 4760	4980	ooglecrashhandler64.exe	94
PID 4760 wrote to memory of 4216	4760	fqmsedge.exe	95
PID 4760 wrote to memory of 4216	4760	fqmsedge.exe	95
PID 4760 wrote to memory of 4216	4760	fqmsedge.exe	95
PID 4760 wrote to memory of 3332	4760	fqmsedge.exe	96
PID 4760 wrote to memory of 3332	4760	fqmsedge.exe	96
PID 4760 wrote to memory of 3332	4760	fqmsedge.exe	96
PID 3332 wrote to memory of 4956	3332	tification_helper.exe	97
PID 3332 wrote to memory of 4956	3332	tification_helper.exe	97
PID 3332 wrote to memory of 4956	3332	tification_helper.exe	97

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1576	attrib.exe
628	attrib.exe

C:\Users\Admin\AppData\Local\Temp\77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe
"C:\Users\Admin\AppData\Local\Temp\77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\wsgsil3uto1zfw.exe
  C:\Users\Admin\AppData\Local\Temp\wsgsil3uto1zfw.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Program Files (x86)\Google\Update\1.3.36.371\ooglecrashhandler64.exe
    "C:\Program Files (x86)\Google\Update\1.3.36.371\ooglecrashhandler64.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\fqmsedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\fqmsedge.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4760
    - - C:\Program Files (x86)\Google\Update\1.3.36.371\ooglecrashhandler64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.371\ooglecrashhandler64.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\tification_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\tification_helper.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3332
      - C:\Program Files (x86)\Microsoft\Edge\Application\fqmsedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\fqmsedge.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 2464
      4⤵
      Program crash
      PID:1400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jvyg862er.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\wsgsil3uto1zfw.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jvyg862er.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\attrib.exe
    attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658N.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4980 -ip 4980
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jvyg862er.bat

Filesize
254B

MD5
c8d7260e1888f4a2efafc3fbaf951d31

SHA1
d77f3904e9287136b6930e1d5a374aba18205e24

SHA256
58644323aa2182eaa88717aed2f68348762815886e78b1d3bd17f997a3fb849e

SHA512
a2522ae96f48025d9c643c8f611a3d92a05999562a1381a91cc10af778958b13b30ab3332de412f7201568fcfed9a2a04ee27875b2d4c0eac60f533e80ba6ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\jvyg862er.bat

Filesize
407B

MD5
2dcc63b434ca53a67316f23494fe73ec

SHA1
dc8fb511ae433ce0390c830764aafd55aae9987f

SHA256
b973e732ca0402c9fc64843fb49e68ab2a80aca6f972b3d1fdf847c8c2d26f53

SHA512
28cb8819570267382e22a4c0de20907c642231ff2b42594db7a77ad8c0d916a74a98172106b18abfa47c1200de665b02d673b8bdd83da60222eed72d683f801e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tgikfw61r.txt

Filesize
5KB

MD5
d6975005d1cf1c63ffb49b4fc87b1e32

SHA1
f4512590b87e9342e0f8f7365c8bf5257f1613b5

SHA256
675c19e3ee96df8ff2ed52731ab931c80013dc519d4bfb5be7389c45dbc878b8

SHA512
99c5fb07547e72b5c27d374c674330ae9169206612590409d649e8507bf2d784ff3bc36e0ff2ab1c65cc8b4d5655f63b8b0b4fd7bac126a55a728f6635e840ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsgsil3uto1zfw.exe

Filesize
444KB

MD5
2795a515f1d8eb3f3ff92739d6229f60

SHA1
b29bc5cac4c7cd462a8080387a4ebc8cca205457

SHA256
77d8470f5aa800be7be4fdd2c2cf280d347a7c0f61ee2fc381c5e62cdae3a658

SHA512
5ff87068a2954e2a6c19a355a5fb7c5b2aabeba970ee5df82a08888efb8ae3fe0ac17391e76998a168b8cdd8b61555cf86e934cd278525a7035a0087e16ad798

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads