d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e

Analysis

max time kernel
108s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2024, 16:45 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe
Size

610KB
MD5

1ba38f5f97fabec29a9c38361a5ba85a
SHA1

be15152c9e7716f047c7d70e64cc7a31f928092e
SHA256

d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e
SHA512

8087770f00e8ca798ba4603e0a3fd44f954b427186dc6fdd9b9618adf48c587e7c9b46669d3952b39057ba9a9b66c94d72e34d55f7b9a0486df52fed0e2fefa8
SSDEEP

12288:mATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+E:4T+KjUdQqboyyWoK1NGqzuhh

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2160	3892	WerFault.exe	95
4684	1008	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winver.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1008	d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe
1008	d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3412	Explorer.EXE
Token: SeCreatePagefilePrivilege	3412	Explorer.EXE
Token: SeShutdownPrivilege	3412	Explorer.EXE
Token: SeCreatePagefilePrivilege	3412	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3892	winver.exe
1008	d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 3892	1008	d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe	95
PID 1008 wrote to memory of 3892	1008	d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe	95
PID 1008 wrote to memory of 3892	1008	d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe	95
PID 1008 wrote to memory of 3892	1008	d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe	95
PID 3892 wrote to memory of 3412	3892	winver.exe	56
PID 1008 wrote to memory of 3412	1008	d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe	56
PID 1008 wrote to memory of 2672	1008	d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe	45

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2672

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3412
- C:\Users\Admin\AppData\Local\Temp\d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe
  "C:\Users\Admin\AppData\Local\Temp\d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 300
      4⤵
      Program crash
      PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 1000
    3⤵
    - Program crash
    PID:4684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3892 -ip 3892
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1008 -ip 1008
1⤵
PID:4548

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

13.86.106.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.86.106.20.in-addr.arpa

IN PTR

Response
DNS

101.209.201.84.in-addr.arpa

Remote address:

8.8.8.8:53

Request

101.209.201.84.in-addr.arpa

IN PTR

Response
DNS

20.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

20.160.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

154.239.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.239.44.20.in-addr.arpa

IN PTR

Response
DNS

209.205.72.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.205.72.20.in-addr.arpa

IN PTR

Response
DNS

50.23.12.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.23.12.20.in-addr.arpa

IN PTR

Response
DNS

171.39.242.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.39.242.20.in-addr.arpa

IN PTR

Response
DNS

35.166.122.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.166.122.92.in-addr.arpa

IN PTR

Response

35.166.122.92.in-addr.arpa

IN PTR

a92-122-166-35deploystaticakamaitechnologiescom
DNS

elitiorecfreetoo.cc

d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe

Remote address:

8.8.8.8:53

Request

elitiorecfreetoo.cc

IN A

Response

elitiorecfreetoo.cc

IN A

216.218.185.162
DNS

151.133.100.95.in-addr.arpa

Remote address:

8.8.8.8:53

Request

151.133.100.95.in-addr.arpa

IN PTR

Response

151.133.100.95.in-addr.arpa

IN PTR

a95-100-133-151deploystaticakamaitechnologiescom
DNS

30.243.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

30.243.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

101.209.201.84.in-addr.arpa

dns

73 B
133 B
1
1

DNS Request

101.209.201.84.in-addr.arpa
8.8.8.8:53

13.86.106.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

13.86.106.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

20.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

20.160.190.20.in-addr.arpa
8.8.8.8:53

154.239.44.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

154.239.44.20.in-addr.arpa
8.8.8.8:53

209.205.72.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

209.205.72.20.in-addr.arpa
8.8.8.8:53

50.23.12.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

50.23.12.20.in-addr.arpa
8.8.8.8:53

171.39.242.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

171.39.242.20.in-addr.arpa
8.8.8.8:53

35.166.122.92.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

35.166.122.92.in-addr.arpa
8.8.8.8:53

elitiorecfreetoo.cc

dns

d70bdd2794d2efe0487361fb5e31c3d8bae8c2fa10a3ff434c58bdd3ffd2645e.exe

65 B
81 B
1
1

DNS Request

elitiorecfreetoo.cc

DNS Response

216.218.185.162
8.8.8.8:53

30.243.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

30.243.111.52.in-addr.arpa
8.8.8.8:53

151.133.100.95.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

151.133.100.95.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-1-0x0000000004560000-0x0000000004BB8000-memory.dmp

Filesize
6.3MB

Download
memory/1008-2-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/1008-4-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1008-12-0x0000000005AB0000-0x00000000064B0000-memory.dmp

Filesize
10.0MB

Download
memory/1008-14-0x0000000005AB0000-0x00000000064B0000-memory.dmp

Filesize
10.0MB

Download
memory/1008-18-0x0000000004560000-0x0000000004BB8000-memory.dmp

Filesize
6.3MB

Download
memory/2672-13-0x0000000000CD0000-0x0000000000CD6000-memory.dmp

Filesize
24KB

Download
memory/2672-19-0x0000000000CD0000-0x0000000000CD6000-memory.dmp

Filesize
24KB

Download
memory/3412-5-0x0000000001000000-0x0000000001006000-memory.dmp

Filesize
24KB

Download
memory/3412-6-0x0000000001000000-0x0000000001006000-memory.dmp

Filesize
24KB

Download
memory/3412-11-0x0000000002960000-0x0000000002966000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.