Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:46

General

  • Target

    9a208ce9535e178e03f9afdaa5eb82f11e3db483cdad10f8ed209b172b1f9ca1N.exe

  • Size

    3.3MB

  • MD5

    51fd84738d1d4ecd8382e0b692fcdd00

  • SHA1

    8d09806ac628730d6c997e0ccc3e8c16dcba0fec

  • SHA256

    9a208ce9535e178e03f9afdaa5eb82f11e3db483cdad10f8ed209b172b1f9ca1

  • SHA512

    ea4dc919b0f48f43c330386d558d7bf1d557657b27d359f0722638d47ee8ab54bc67bba1b7c9afe7a87914308d17f644dc0cbecdd9b112a3295481b664a2c139

  • SSDEEP

    98304:SCZ9i2QPOTCUqt3T7uUlHVTKpoMhXKTRsqU:SCZ3QmOrp71HAniaL

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a208ce9535e178e03f9afdaa5eb82f11e3db483cdad10f8ed209b172b1f9ca1N.exe
    "C:\Users\Admin\AppData\Local\Temp\9a208ce9535e178e03f9afdaa5eb82f11e3db483cdad10f8ed209b172b1f9ca1N.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:452
    • \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
      c:\users\admin\appdata\local\temp\\wmpscfgs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4216
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 672
        3⤵
        • Program crash
        PID:3164
    • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
      C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3968
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 676
        3⤵
        • Program crash
        PID:2284
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3968 -ip 3968
    1⤵
      PID:1220
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4216 -ip 4216
      1⤵
        PID:4688

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

              Filesize

              3.3MB

              MD5

              d1584ac9e9ae113486d1638be086b44e

              SHA1

              15261c6ae05e646642aaf01ff2ccda27ffb62c26

              SHA256

              d02f31fb436c183ac8c664fc4973537ce559c75e80b33b42b8757b58155fca89

              SHA512

              d3f5d171e5c1bdf4d74673ea2f55a5e7515d53a33e30f0facee10831429f4ebb35033423d1213a61a57d3c6049e3d160298664af7f6403fde209087902c7561a

            • C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

              Filesize

              3.3MB

              MD5

              9d8d229e4429d2fdf97a158fae93e09d

              SHA1

              2fb04ca0c4e0434620640a59d8a3c36dceb017f2

              SHA256

              b7cf1cc40af12aaf9e528833267d04c03b962bca7f44e94a3ec9504043a97550

              SHA512

              b57e7c0b5123c33a88d0a2d3dea1f76109803d99cb2ad25025e157f7cc9b1920cf391656f5aa2f627e976d3df71b6b42cc5787765eb280879f3cf042e11dc534

            • memory/452-18-0x000000007FA70000-0x000000007FE41000-memory.dmp

              Filesize

              3.8MB

            • memory/452-2-0x0000000010000000-0x0000000010010000-memory.dmp

              Filesize

              64KB

            • memory/452-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

              Filesize

              3.8MB

            • memory/452-0-0x0000000000400000-0x0000000000DBB000-memory.dmp

              Filesize

              9.7MB

            • memory/452-17-0x0000000000400000-0x0000000000DBB000-memory.dmp

              Filesize

              9.7MB

            • memory/3968-16-0x0000000000400000-0x0000000000DBB000-memory.dmp

              Filesize

              9.7MB

            • memory/3968-20-0x000000007FA70000-0x000000007FE41000-memory.dmp

              Filesize

              3.8MB

            • memory/3968-24-0x0000000000400000-0x0000000000DBB000-memory.dmp

              Filesize

              9.7MB

            • memory/3968-25-0x000000007FA70000-0x000000007FE41000-memory.dmp

              Filesize

              3.8MB

            • memory/4216-19-0x000000007FA70000-0x000000007FE41000-memory.dmp

              Filesize

              3.8MB

            • memory/4216-21-0x0000000000400000-0x0000000000DBB000-memory.dmp

              Filesize

              9.7MB

            • memory/4216-22-0x000000007FA70000-0x000000007FE41000-memory.dmp

              Filesize

              3.8MB