Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2024, 00:07
Static task
static1
Behavioral task
behavioral1
Sample
7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe
Resource
win7-20241010-en
General
-
Target
7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe
-
Size
629KB
-
MD5
793cfdff72eb3163f704c3f9b3b3c717
-
SHA1
61534379b1cd8d8f8280b676972c28b30d7a0484
-
SHA256
7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e
-
SHA512
c4f532662fa063fd05a115e8a6c883204dbc2fab2c66378d448625d979a730d719d620bee3988bffec5bc4ea7bf46e6bafc0b0b1bcead0082f44ff834aa306ea
-
SSDEEP
12288:0pdVfrKp5SBUOvkD/gKVGDHszAVXMG2n+z2x0K73AVdxGbw6H3MLVi:0pd9K7MlGXwz+AV8G2OpvcwL
Malware Config
Signatures
-
Adwind family
-
Class file contains resources related to AdWind 1 IoCs
resource yara_rule sample family_adwind4 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2856 javaw.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2856 2920 7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe 89 PID 2920 wrote to memory of 2856 2920 7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe"C:\Users\Admin\AppData\Local\Temp\7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\feesa.jar"2⤵
- Suspicious use of SetWindowsHookEx
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
639KB
MD5f8efbadc189bc31378bb79f809418cbb
SHA1b9d08cb99649523e96def357b3407d222422a42e
SHA256b6c3ed6909c2cef457d966c5bb53e03d48467f05cc1c8c9d144a64f58db97554
SHA5122e417e788928dc1f1e8db8268147db2ab830a621d6a893bdff153e5270ebbf152c77a5110ff9230371daff67cbd98eff4467858ebfa59629becfbfb56b11e501