Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 11:52
Behavioral task
behavioral1
Sample
7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe
Resource
win10v2004-20241007-en
General
-
Target
7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe
-
Size
112KB
-
MD5
d6dec4a282945d2b7c9afd6ca65de264
-
SHA1
6c01b47e8efba2f38a1a0df61bef84d701269e4d
-
SHA256
7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7
-
SHA512
a789dbf76a26d6c214c56b07ecd8e5c2afb00bf0caba0d82dae85f56fd2b165dd548987f0eb61c06387a8628809f337f3301907c2107d6eb0e6a003eae3e7edc
-
SSDEEP
768:GKEBUUC151Npquv3Rn4KE7pRnbcuyD7UYEo:ToU5bLpXRxMnouy8Do
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe -
Executes dropped EXE 1 IoCs
pid Process 1748 WAMain.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
resource yara_rule behavioral2/memory/2164-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000e000000023b32-16.dat upx behavioral2/memory/2164-26-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1748-27-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe Token: SeDebugPrivilege 1748 WAMain.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2164 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 1748 WAMain.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2164 wrote to memory of 1908 2164 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 87 PID 2164 wrote to memory of 1908 2164 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 87 PID 2164 wrote to memory of 1908 2164 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 87 PID 1908 wrote to memory of 3564 1908 cmd.exe 90 PID 1908 wrote to memory of 3564 1908 cmd.exe 90 PID 1908 wrote to memory of 3564 1908 cmd.exe 90 PID 2164 wrote to memory of 1748 2164 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 91 PID 2164 wrote to memory of 1748 2164 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 91 PID 2164 wrote to memory of 1748 2164 7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe"C:\Users\Admin\AppData\Local\Temp\7792b8a24b7d77f3b570bcc4a09f8bc4dc04905d0442ec41ec0fafccd082d2f7.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DYCQG.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3564
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
Filesize
112KB
MD53ab34ab69975eb14d44470fa2d35ed14
SHA14190c985040b3d770d9eeaf93b70a55628eb7eb8
SHA256f47f15453c7b35763bf370604f0423b0b98b55a4269eb092bf6fabc4073ce033
SHA5123a627b7580ded1b14394dd0939595c7d319448b31fee41283b4c124e814f6fd5c5bbb495a5fb69e62d32e7413ce45c607cdd08dbe38375df6539dc12d9443c24