Overview
overview
10Static
static
1MilwaukeeRivers.exe
windows7-x64
10MilwaukeeRivers.exe
windows10-2004-x64
10.data
windows7-x64
3.data
windows10-2004-x64
3.rdata
windows7-x64
3.rdata
windows10-2004-x64
3.reloc
windows7-x64
3.reloc
windows10-2004-x64
3.rsrc/DIALOG/105
windows7-x64
1.rsrc/DIALOG/105
windows10-2004-x64
1.rsrc/DIALOG/106
windows7-x64
1.rsrc/DIALOG/106
windows10-2004-x64
1.rsrc/DIALOG/111
windows7-x64
1.rsrc/DIALOG/111
windows10-2004-x64
1.rsrc/GROUP_ICON/103
windows7-x64
1.rsrc/GROUP_ICON/103
windows10-2004-x64
1.rsrc/ICON/1.ico
windows7-x64
3.rsrc/ICON/1.ico
windows10-2004-x64
3.rsrc/MANIFEST/1.xml
windows7-x64
3.rsrc/MANIFEST/1.xml
windows10-2004-x64
1.rsrc/version.txt
windows7-x64
1.rsrc/version.txt
windows10-2004-x64
1.text
windows7-x64
3.text
windows10-2004-x64
3CERTIFICATE
windows7-x64
1CERTIFICATE
windows10-2004-x64
1[0]
windows7-x64
1[0]
windows10-2004-x64
1[1]
windows7-x64
1[1]
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 10:18
Static task
static1
Behavioral task
behavioral1
Sample
MilwaukeeRivers.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
MilwaukeeRivers.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
.data
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
.data
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
.rdata
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
.rdata
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
.reloc
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
.reloc
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
.rsrc/DIALOG/105
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
.rsrc/DIALOG/105
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
.rsrc/DIALOG/106
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
.rsrc/DIALOG/106
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
.rsrc/DIALOG/111
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
.rsrc/DIALOG/111
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
.rsrc/GROUP_ICON/103
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
.rsrc/GROUP_ICON/103
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
.rsrc/ICON/1.ico
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
.rsrc/ICON/1.ico
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
.rsrc/MANIFEST/1.xml
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
.rsrc/MANIFEST/1.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
.rsrc/version.txt
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
.rsrc/version.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
.text
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
.text
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
CERTIFICATE
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
CERTIFICATE
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
[0]
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
[0]
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
[1]
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
[1]
Resource
win10v2004-20241007-en
General
-
Target
.reloc
-
Size
4KB
-
MD5
28eb16c084f743398eac7a551641079b
-
SHA1
38874b4ed095894438e4bd70166c73a95200cb79
-
SHA256
11291a89c647ba84f2cca631a3ba8d8b8cc2821580bb9f4c78be1f8965541db3
-
SHA512
1e352b3489251a48811e442e0a89ec5f5004a0f1040d281eab1f38b9a79dd368f2e0feea2b34ad6dbcd8d8369aa9f89e6b187907175da2e7ae09a4d1eb256d63
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2816 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2816 AcroRd32.exe 2816 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2260 2864 cmd.exe 32 PID 2864 wrote to memory of 2260 2864 cmd.exe 32 PID 2864 wrote to memory of 2260 2864 cmd.exe 32 PID 2260 wrote to memory of 2816 2260 rundll32.exe 33 PID 2260 wrote to memory of 2816 2260 rundll32.exe 33 PID 2260 wrote to memory of 2816 2260 rundll32.exe 33 PID 2260 wrote to memory of 2816 2260 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\.reloc1⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\.reloc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\.reloc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50079862dcaaf507f4ed28db076e0d7d9
SHA154cb35466dc08e8292d330e9683394e7f7f07068
SHA256aaee319d5acfa68684785accf4a73bbe2f2d260821663cccc39693ffe047bde8
SHA512674b7708e9c735d173d2845004124cc7ee0e3e4e0fed0ab70c5d3fe8ede9eac3fde3e2bcd6f8ebe3072d5df8f280aabacd26da6b0552afc392847d7fbfe72d11