Analysis

  • max time kernel
    112s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/10/2024, 23:58

General

  • Target

    e60179643bb8377870934cf549175eb8e7dd597d0bd7af0f060f57afcaa06979N.exe

  • Size

    47KB

  • MD5

    3edb692824c12520bfcbd726f3b6b640

  • SHA1

    b64111029d92f46087fde44132ef8b086456e780

  • SHA256

    e60179643bb8377870934cf549175eb8e7dd597d0bd7af0f060f57afcaa06979

  • SHA512

    1a2690ee6ca9d18a6e4fd72dc74e0ef67e518f541122bd9db5ef3f51939e85bef7bcb143b1de9242cfcbd34130faa26225f1f223c81d2b0f5f89f4f1c8999d96

  • SSDEEP

    768:DA+2Xb0h0V3AXfZM1iwe/a/3Ov5c3C0GHgWcR:DAZbT3pipveydxcR

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e60179643bb8377870934cf549175eb8e7dd597d0bd7af0f060f57afcaa06979N.exe
    "C:\Users\Admin\AppData\Local\Temp\e60179643bb8377870934cf549175eb8e7dd597d0bd7af0f060f57afcaa06979N.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4812
    • \??\c:\users\admin\appdata\local\temp\e60179643bb8377870934cf549175eb8e7dd597d0bd7af0f060f57afcaa06979n.exe
      c:\users\admin\appdata\local\temp\e60179643bb8377870934cf549175eb8e7dd597d0bd7af0f060f57afcaa06979n.exe
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1032
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
        • Sets service image path in registry
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:3976
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 348
          4⤵
          • Program crash
          PID:2380
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3976 -ip 3976
    1⤵
      PID:216

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\windows\SysWOW64\mssrv32.exe

      Filesize

      47KB

      MD5

      3edb692824c12520bfcbd726f3b6b640

      SHA1

      b64111029d92f46087fde44132ef8b086456e780

      SHA256

      e60179643bb8377870934cf549175eb8e7dd597d0bd7af0f060f57afcaa06979

      SHA512

      1a2690ee6ca9d18a6e4fd72dc74e0ef67e518f541122bd9db5ef3f51939e85bef7bcb143b1de9242cfcbd34130faa26225f1f223c81d2b0f5f89f4f1c8999d96

    • memory/1032-6-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/3976-7-0x0000000015110000-0x000000001511A000-memory.dmp

      Filesize

      40KB

    • memory/3976-10-0x0000000015110000-0x000000001511A000-memory.dmp

      Filesize

      40KB

    • memory/3976-12-0x0000000015110000-0x000000001511A000-memory.dmp

      Filesize

      40KB

    • memory/4812-0-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/4812-1-0x0000000000408000-0x0000000000409000-memory.dmp

      Filesize

      4KB

    • memory/4812-2-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/4812-4-0x0000000000408000-0x0000000000409000-memory.dmp

      Filesize

      4KB