Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 16:48
Static task
static1
Behavioral task
behavioral1
Sample
59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe
Resource
win10v2004-20241007-en
General
-
Target
59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe
-
Size
1.7MB
-
MD5
d0a2ce9c3713480f80a4ba511d926e10
-
SHA1
6b4bcb74a6303b50f9360f44af9301debdae57e7
-
SHA256
59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6d
-
SHA512
b83cf9567617b86beef564709d48e44be007c6104dd1553fca66207882764324c87ace82f674c5beb0c2f9eb8a3a8a56f3f2546e8a0618e6f145140a1e5f26a4
-
SSDEEP
24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNz:mbTChxKCnFnQXBbrtgb/iQvu0UHOq
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WdExt.exelaunch.exe59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WdExt.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation launch.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe -
Executes dropped EXE 4 IoCs
Processes:
WdExt.exelaunch.exewtmps.exemscaps.exepid Process 1412 WdExt.exe 2108 launch.exe 2840 wtmps.exe 4408 mscaps.exe -
Loads dropped DLL 2 IoCs
Processes:
59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exeWdExt.exepid Process 4320 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe 1412 WdExt.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
launch.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe -
Drops file in System32 directory 2 IoCs
Processes:
wtmps.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exeWdExt.execmd.exelaunch.execmd.exewtmps.exe59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtmps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exeWdExt.exelaunch.exepid Process 4320 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe 4320 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe 1412 WdExt.exe 1412 WdExt.exe 2108 launch.exe 2108 launch.exe 2108 launch.exe 2108 launch.exe 2108 launch.exe 2108 launch.exe 2108 launch.exe 2108 launch.exe 2108 launch.exe 2108 launch.exe 2108 launch.exe 2108 launch.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.execmd.exeWdExt.execmd.exelaunch.execmd.exewtmps.exedescription pid Process procid_target PID 4320 wrote to memory of 4152 4320 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe 86 PID 4320 wrote to memory of 4152 4320 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe 86 PID 4320 wrote to memory of 4152 4320 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe 86 PID 4320 wrote to memory of 2908 4320 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe 88 PID 4320 wrote to memory of 2908 4320 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe 88 PID 4320 wrote to memory of 2908 4320 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe 88 PID 4152 wrote to memory of 1412 4152 cmd.exe 90 PID 4152 wrote to memory of 1412 4152 cmd.exe 90 PID 4152 wrote to memory of 1412 4152 cmd.exe 90 PID 1412 wrote to memory of 3736 1412 WdExt.exe 91 PID 1412 wrote to memory of 3736 1412 WdExt.exe 91 PID 1412 wrote to memory of 3736 1412 WdExt.exe 91 PID 3736 wrote to memory of 2108 3736 cmd.exe 93 PID 3736 wrote to memory of 2108 3736 cmd.exe 93 PID 3736 wrote to memory of 2108 3736 cmd.exe 93 PID 2108 wrote to memory of 3308 2108 launch.exe 94 PID 2108 wrote to memory of 3308 2108 launch.exe 94 PID 2108 wrote to memory of 3308 2108 launch.exe 94 PID 3308 wrote to memory of 2840 3308 cmd.exe 96 PID 3308 wrote to memory of 2840 3308 cmd.exe 96 PID 3308 wrote to memory of 2840 3308 cmd.exe 96 PID 2840 wrote to memory of 4408 2840 wtmps.exe 97 PID 2840 wrote to memory of 4408 2840 wtmps.exe 97 PID 2840 wrote to memory of 4408 2840 wtmps.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe"C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 14125⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe8⤵
- Executes dropped EXE
PID:4408
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
406B
MD537512bcc96b2c0c0cf0ad1ed8cfae5cd
SHA1edf7f17ce28e1c4c82207cab8ca77f2056ea545c
SHA25627e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
SHA5126d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
-
Filesize
276KB
MD575c1467042b38332d1ea0298f29fb592
SHA1f92ea770c2ddb04cf0d20914578e4c482328f0f8
SHA2563b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
SHA5125c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
-
Filesize
172KB
MD5daac1781c9d22f5743ade0cb41feaebf
SHA1e2549eeeea42a6892b89d354498fcaa8ffd9cac4
SHA2566a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
SHA512190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
-
Filesize
1.2MB
MD5e2e93857f8ea5ff3130d5779e559bcb5
SHA1aeeb643eb80aae49caa357f9cf4c4157a339a845
SHA256f9b0f6d989db651bb433efc0ed90ab758d17c0d738a703a8218cf7e9d3847580
SHA512d9aeec44b8f464cff0f0b48de58b65385f39cd53daa8b893241e2c3169033cbe75e03650df47f524007e0b61361e20745ced483b832e62248065066f0b4504bd
-
Filesize
1.7MB
MD53d165846ea6a86c9850c254e0cd012cd
SHA1cafbf4f01e7a5ed2e1fa0efb4762ae84589cf85a
SHA256b886c36c06e0712e1d3e72700d47ff43fafe89dd9d41274a9ddf1e0ec808e439
SHA51263818d2fe265ef79c4f8ea21c786fb94f2879bf4f8ac2285009b3f80fa2290e0f7d24e61bb4a2eab4c775899a0de70b7b714ee62f347796a620cf3d0b2966ac2
-
Filesize
129B
MD5d1073c9b34d1bbd570928734aacff6a5
SHA178714e24e88d50e0da8da9d303bec65b2ee6d903
SHA256b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
SHA5124f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
-
Filesize
304B
MD5fb6b21742affc21307818e4c3d1bcfec
SHA1158898d3e999db397fa5d42e1967dfb287e13566
SHA2562996c755a0970493cb10d72d2ba86fcf1fdcb925d4c660b869ca6289a4f7e95a
SHA51218e6d76ef737e6ba7ca32eb589a3850a17a3d7445619ece06ad1dde34b47782a45bc3a70951f5df8c632061951f0418b0b56d7d3df1b39024088f347f437ae0a
-
Filesize
126B
MD5b3263e14706f0a89ce18bb2cddd794e4
SHA1794b3b74135923d476c00b42e5a3d0fb2931fca2
SHA256dee0cfbd6e43cc4093e53c3eb8c0a9ab42e3eab1950622aa2d4eece34a364694
SHA512d268489ecd1c8422ab3706dd2e8d428ebe79d764ef54c4752c76281de75be5c8c1ad746529ad66536f24a306c12bf57c67484b19151d87e5ffebac07ce136982
-
Filesize
102B
MD53ca08f080a7a28416774d80552d4aa08
SHA10b5f0ba641204b27adac4140fd45dce4390dbf24
SHA2564e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
SHA5120c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
-
Filesize
388KB
MD5e1e47695a0b98432911311352b63eaed
SHA1836142e550301e0fc13c1a047aae5a2f4481d7cd
SHA256c67ed34d9254b31e611ee830125c3f2572a1e686f82deb69e1580fb9a4614cd0
SHA512da49234ee2e1d8f9956ba59d4a49fe04d3ab154f5dd60cf7a6c72e9d42defe8a4b0aeb38845444fe3a8d9c80976467d2101f7c992a48f98f6a9317d0e61ca961
-
Filesize
388KB
MD58d7db101a7211fe3309dc4dc8cf2dd0a
SHA16c2781eadf53b3742d16dab2f164baf813f7ac85
SHA25693db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
SHA5128b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83
-
Filesize
200KB
MD578d3c8705f8baf7d34e6a6737d1cfa18
SHA19f09e248a29311dbeefae9d85937b13da042a010
SHA2562c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
SHA5129a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609