5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552

General

Target

5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe
Size

164KB
MD5

99253e52818cc1159a712dd95be38870
SHA1

e4bc9f7c20088b9d885ddbf906cfa76788356bb3
SHA256

5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552
SHA512

b565d7f1b7555cb08ae9199386b4ec3b79365144022a726b84fe0c3c0d25872de54da179169aa25d4c0220db660d422bf540a2be1084f4dfd36922ac7549beab
SSDEEP

3072:kBLOSC0BiaynVRNNFwaSNDe1Fclgr+0StmnJza3yD/CLO:/SC0Bf8wve1FbRWmYi4O

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 2176	4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	3940	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winver.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe
4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe
3940	winver.exe
3940	winver.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3588	Explorer.EXE
Token: SeCreatePagefilePrivilege	3588	Explorer.EXE
Token: SeShutdownPrivilege	3588	Explorer.EXE
Token: SeCreatePagefilePrivilege	3588	Explorer.EXE
Token: SeShutdownPrivilege	3588	Explorer.EXE
Token: SeCreatePagefilePrivilege	3588	Explorer.EXE
Token: SeShutdownPrivilege	3588	Explorer.EXE
Token: SeCreatePagefilePrivilege	3588	Explorer.EXE
Token: SeShutdownPrivilege	3588	Explorer.EXE
Token: SeCreatePagefilePrivilege	3588	Explorer.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3940	winver.exe
3588	Explorer.EXE
3588	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe
4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3588	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2176	4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	83
PID 4284 wrote to memory of 2176	4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	83
PID 4284 wrote to memory of 2176	4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	83
PID 4284 wrote to memory of 2176	4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	83
PID 4284 wrote to memory of 2176	4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	83
PID 4284 wrote to memory of 2176	4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	83
PID 4284 wrote to memory of 2176	4284	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	83
PID 2176 wrote to memory of 3940	2176	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	85
PID 2176 wrote to memory of 3940	2176	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	85
PID 2176 wrote to memory of 3940	2176	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	85
PID 2176 wrote to memory of 3940	2176	5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe	85
PID 3940 wrote to memory of 3588	3940	winver.exe	56
PID 3940 wrote to memory of 2616	3940	winver.exe	44

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2616

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
PID:3588
- C:\Users\Admin\AppData\Local\Temp\5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe
  "C:\Users\Admin\AppData\Local\Temp\5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Users\Admin\AppData\Local\Temp\5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe
    C:\Users\Admin\AppData\Local\Temp\5156c46a75424fe58b6f120445dd703c3fa349bc64003ac727ee9f44ab0de552N.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\SysWOW64\winver.exe
      winver
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 396
        5⤵
        Program crash
        
        PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3940 -ip 3940
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-1-0x0000000000400000-0x000000000149A000-memory.dmp

Filesize
16.6MB

Download
memory/2176-6-0x0000000000400000-0x0000000000404400-memory.dmp

Filesize
17KB

Download
memory/2616-13-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/2616-18-0x00007FFA42B70000-0x00007FFA42B71000-memory.dmp

Filesize
4KB

Download
memory/2616-14-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/3588-5-0x0000000000DB0000-0x0000000000DB6000-memory.dmp

Filesize
24KB

Download
memory/3588-2-0x0000000000DB0000-0x0000000000DB6000-memory.dmp

Filesize
24KB

Download
memory/3588-8-0x00007FFA429ED000-0x00007FFA429EE000-memory.dmp

Filesize
4KB

Download
memory/3588-17-0x00007FFA42B60000-0x00007FFA42B61000-memory.dmp

Filesize
4KB

Download
memory/3588-10-0x00007FFA42B80000-0x00007FFA42B81000-memory.dmp

Filesize
4KB

Download
memory/3940-3-0x0000000000B90000-0x0000000000B96000-memory.dmp

Filesize
24KB

Download
memory/3940-9-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/3940-15-0x0000000000B90000-0x0000000000B96000-memory.dmp

Filesize
24KB

Download
memory/3940-7-0x0000000077162000-0x0000000077163000-memory.dmp

Filesize
4KB

Download
memory/4284-0-0x0000000002390000-0x0000000002394000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing