Analysis

  • max time kernel
    90s
  • max time network
    92s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 12:06

General

  • Target

    f2e7f09f6fe98a130e5b96531c327e419e273729f6aaa218b6918ed3e564c7fd.exe

  • Size

    944KB

  • MD5

    32eea9cb52ac61c5a73d45baea3a8c24

  • SHA1

    5cd2600b24e0eaa94e225f5f3f571a1842a99381

  • SHA256

    f2e7f09f6fe98a130e5b96531c327e419e273729f6aaa218b6918ed3e564c7fd

  • SHA512

    cb895ad909a37197daa0a3a8447de3d5278270d3f690b24c15137269a20409d67fdd106b29e7b591e4ec3c934be262e8f4a4d8d014b44a5665960a38c2e26b9b

  • SSDEEP

    24576:v6Zv2ivhBVnFvh5Q44+iiEb0f2Q5tZz1MrVTPh14w:vE2ivhhUK9f9DpMD1T

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2e7f09f6fe98a130e5b96531c327e419e273729f6aaa218b6918ed3e564c7fd.exe
    "C:\Users\Admin\AppData\Local\Temp\f2e7f09f6fe98a130e5b96531c327e419e273729f6aaa218b6918ed3e564c7fd.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:3856
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 744
      2⤵
      • Program crash
      PID:3744
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3856 -ip 3856
    1⤵
      PID:4568

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SysWOW64\concp32.exe

            Filesize

            948KB

            MD5

            930f76c4f0f7dd6d6ee8b1dfe2a28065

            SHA1

            b79de22e2dcf4bb807af9e9e74a031af38afd8b4

            SHA256

            22f50e25a65ff0691a382f3c672cedee5951581ddb543a9db2f1293c08ca397c

            SHA512

            5040e234d83c839571310ab40c0e73f907b50b8e24e18dd30d8dab857630d7f9031781a5af4b47e917578fec751e4a7f8051db13486a54c25d1527d7de87ad0b

          • memory/3856-0-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB

          • memory/3856-7-0x0000000000400000-0x0000000000439000-memory.dmp

            Filesize

            228KB