Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 11:52
Behavioral task
behavioral1
Sample
7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe
Resource
win10v2004-20241007-en
General
-
Target
7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe
-
Size
112KB
-
MD5
d6dec4a282945d2b7c9afd6ca65de264
-
SHA1
6c01b47e8efba2f38a1a0df61bef84d701269e4d
-
SHA256
7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7
-
SHA512
a789dbf76a26d6c214c56b07ecd8e5c2afb00bf0caba0d82dae85f56fd2b165dd548987f0eb61c06387a8628809f337f3301907c2107d6eb0e6a003eae3e7edc
-
SSDEEP
768:GKEBUUC151Npquv3Rn4KE7pRnbcuyD7UYEo:ToU5bLpXRxMnouy8Do
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1744 WAMain.exe -
Loads dropped DLL 5 IoCs
pid Process 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
resource yara_rule behavioral1/memory/2368-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x0008000000012117-37.dat upx behavioral1/memory/1744-41-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2368-44-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1744-45-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe Token: SeDebugPrivilege 1744 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 1744 WAMain.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2368 wrote to memory of 3056 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 30 PID 2368 wrote to memory of 3056 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 30 PID 2368 wrote to memory of 3056 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 30 PID 2368 wrote to memory of 3056 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 30 PID 3056 wrote to memory of 2516 3056 cmd.exe 32 PID 3056 wrote to memory of 2516 3056 cmd.exe 32 PID 3056 wrote to memory of 2516 3056 cmd.exe 32 PID 3056 wrote to memory of 2516 3056 cmd.exe 32 PID 2368 wrote to memory of 1744 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 33 PID 2368 wrote to memory of 1744 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 33 PID 2368 wrote to memory of 1744 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 33 PID 2368 wrote to memory of 1744 2368 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe"C:\Users\Admin\AppData\Local\Temp\7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\WWJLG.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2516
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD5b75072e51426bd71b45b473d93a6078c
SHA1347dd180dd2a1942631ba7e9f9e684db61670cd4
SHA2562c4bc193d81d76df3ad2d8295e2326a93100edb858650a80f2b3a99a3cf2b21d
SHA51262124b2f52bbe481a77d2f1d42ecae04aea8f767c5a1d36cacae76dfe7c902884358b23f3e1045afe03b0ceab9318359113834dd5c26da4bc75523f9e6689fce