Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/11/2024, 23:05
Static task
static1
Behavioral task
behavioral1
Sample
e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe
Resource
win10v2004-20241007-en
General
-
Target
e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe
-
Size
1.1MB
-
MD5
8aa7ce5be8031fd959ba8eeab21563e2
-
SHA1
c71c9aed980df363868e17a659b17271bed4296c
-
SHA256
e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22
-
SHA512
3aacea624f444151992dde56fc8889bb50da5019d44872390ec91fd1107e76636bb2e71d3d5dec1aff99c06603dc22bb1d09a6b05002f75c87221fd31874586c
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iaXIkXuMJhQjJ8MhA:mJZoQrbTFZY1iaXIkwm
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\parterres.vbs parterres.exe -
Executes dropped EXE 1 IoCs
pid Process 4108 parterres.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000c000000023b73-5.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1060 4108 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language parterres.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3136 wrote to memory of 4108 3136 e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe 86 PID 3136 wrote to memory of 4108 3136 e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe 86 PID 3136 wrote to memory of 4108 3136 e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe 86 PID 4108 wrote to memory of 1664 4108 parterres.exe 88 PID 4108 wrote to memory of 1664 4108 parterres.exe 88 PID 4108 wrote to memory of 1664 4108 parterres.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe"C:\Users\Admin\AppData\Local\Temp\e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\colliquefaction\parterres.exe"C:\Users\Admin\AppData\Local\Temp\e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22.exe"3⤵PID:1664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 7403⤵
- Program crash
PID:1060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4108 -ip 41081⤵PID:2228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD5f3bae1739354bb47feb3eed73d94381a
SHA1d7ee12c196aad3feb0ab294afe2dfbc084c94711
SHA256d7c313b3b9a971813bff3a5abadecb59f590303796006c070fcd4f58b8a94849
SHA512852a1ee262009aba195a0c0d47c1ad67b57ea54c4164c5e79a3809e907310eb2849f6fb8f4ce35c28d03cd1aaa9e3a94143da9b8cbf801521887d3a0f7ce821e
-
Filesize
1.1MB
MD58aa7ce5be8031fd959ba8eeab21563e2
SHA1c71c9aed980df363868e17a659b17271bed4296c
SHA256e1fa5c71c9fab660f8312332cf26e8c78a216ecdbaaa47a4ca04a57f6946bc22
SHA5123aacea624f444151992dde56fc8889bb50da5019d44872390ec91fd1107e76636bb2e71d3d5dec1aff99c06603dc22bb1d09a6b05002f75c87221fd31874586c