Analysis

  • max time kernel
    95s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 23:10

General

  • Target

    72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe

  • Size

    1.5MB

  • MD5

    ed126bca65c242ce6c96c9daeb1ec035

  • SHA1

    24f9ec0223b3469ffd550683c089135bf7e12a94

  • SHA256

    72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be

  • SHA512

    76f8324071475e3e3b0396364091ea67c95faa12f33b4e29550acd230a33e79aedcbf963739442f064a656b4f5a6cf60c39e0f3c4eb3b276efe3cb00fe96684d

  • SSDEEP

    6144:Y17lKgzelZNQSBQGH/CSpWqTTmQAtnRPF9cCGruv04NIqRaXKv7larTQ:YQfBQGH6SfuQAnRNht0XqRTl1

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe
    "C:\Users\Admin\AppData\Local\Temp\72b8ac452310da80b09c7e5ef25cdf1fa1b2ec47983ebae39bcc3c0fa87b83be.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    PID:4308
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 780
      2⤵
      • Program crash
      PID:100
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4308 -ip 4308
    1⤵
      PID:2336

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7z.cab

      Filesize

      544KB

      MD5

      9a1dd1d96481d61934dcc2d568971d06

      SHA1

      f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

      SHA256

      8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

      SHA512

      7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

    • C:\Program Files\7-Zip\7z.exe

      Filesize

      1.5MB

      MD5

      1aff57c81d0a2df9a9a05fe23b48e608

      SHA1

      7ab4bc30ab58d5c578ada6937fcb0bc959f3b252

      SHA256

      825d79982d2bebdaa769a139150b87297ab4af60281ed706427ff04cddbc7868

      SHA512

      844af374c32d82a137f6888996898201b938697e5bdf095b1e91f3a21bc8c8ca128d8dd18c8ab6042d43cecf705cb03bfe42f98556b700fd7be27f57d82ab38c

    • C:\Program Files\7-Zip\7zFM.cab

      Filesize

      930KB

      MD5

      30ac0b832d75598fb3ec37b6f2a8c86a

      SHA1

      6f47dbfd6ff36df7ba581a4cef024da527dc3046

      SHA256

      1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

      SHA512

      505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXB1A3.tmp

      Filesize

      246KB

      MD5

      f92f6883ff4738d8f8710f414e623069

      SHA1

      29e1b67df116a5b5bb019bbe7a2a50edc1946b76

      SHA256

      23014d03cfa93eedc7df229f43a5969bc138a6475c80efe899efebfc1f526646

      SHA512

      945bdcf1a4ad9c36a180d0b9d8689c5f08f741e3036a02c5017227421d34e8e94d99a9bf216e0f3440bde25763a3824f6a4373de4ba8e7ab8b420ad42d61a274

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

      Filesize

      2.1MB

      MD5

      b8d69fa2755c3ab1f12f8866a8e2a4f7

      SHA1

      8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

      SHA256

      7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

      SHA512

      5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

    • memory/4308-0-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB

    • memory/4308-68-0x0000000000400000-0x0000000000485000-memory.dmp

      Filesize

      532KB