Analysis
-
max time kernel
94s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2024 03:26
Behavioral task
behavioral1
Sample
e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe
Resource
win7-20240903-en
General
-
Target
e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe
-
Size
646KB
-
MD5
34e3967c8143fb8822936f1a463b72df
-
SHA1
ddd217ba236011c11af70a60e5942f345cc5039a
-
SHA256
e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777
-
SHA512
4e1633b036e3dfe3405f6580903a938a7f6b43848e4408e2573478b4172e2236ccff8683f982c22cf2a70bf56c9967395ef7c7a5dd58a29cdf244aaa796dcc68
-
SSDEEP
12288:wOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiOHGu+4EIppaL+YQRUXi1h5QryNnts:wq5TfcdHj4fmboOci0kPNnmN
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\juvenile.vbs juvenile.exe -
Executes dropped EXE 1 IoCs
pid Process 4292 juvenile.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1648-14-0x00000000003C0000-0x0000000000535000-memory.dmp autoit_exe behavioral2/memory/4292-24-0x0000000000B60000-0x0000000000CD5000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/1648-0-0x00000000003C0000-0x0000000000535000-memory.dmp upx behavioral2/files/0x0008000000023c6e-10.dat upx behavioral2/memory/4292-12-0x0000000000B60000-0x0000000000CD5000-memory.dmp upx behavioral2/memory/1648-14-0x00000000003C0000-0x0000000000535000-memory.dmp upx behavioral2/memory/4292-24-0x0000000000B60000-0x0000000000CD5000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2828 4292 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language juvenile.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1648 e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe 1648 e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe 4292 juvenile.exe 4292 juvenile.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1648 e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe 1648 e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe 4292 juvenile.exe 4292 juvenile.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1648 wrote to memory of 4292 1648 e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe 84 PID 1648 wrote to memory of 4292 1648 e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe 84 PID 1648 wrote to memory of 4292 1648 e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe 84 PID 4292 wrote to memory of 3488 4292 juvenile.exe 85 PID 4292 wrote to memory of 3488 4292 juvenile.exe 85 PID 4292 wrote to memory of 3488 4292 juvenile.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe"C:\Users\Admin\AppData\Local\Temp\e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\stickers\juvenile.exe"C:\Users\Admin\AppData\Local\Temp\e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe"3⤵PID:3488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 7243⤵
- Program crash
PID:2828
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4292 -ip 42921⤵PID:2248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD53fe19bc1dfa8d356e25dc57b72b5aa07
SHA19b0fe4ba33f4dba514fa5a2a2cdd5fa9c0af008d
SHA2564d86c6d82683ceca0b05e0daa777b1fa0599633eccc778de23ce45939a9d77a4
SHA512f48127e33b518dae6dd1af08d2426bf57943a618d212178aaadabad9cde63419e5c87188f7bb305f4a9d401a13e563890cbff2962792afbe8660598e09edd482
-
Filesize
646KB
MD534e3967c8143fb8822936f1a463b72df
SHA1ddd217ba236011c11af70a60e5942f345cc5039a
SHA256e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777
SHA5124e1633b036e3dfe3405f6580903a938a7f6b43848e4408e2573478b4172e2236ccff8683f982c22cf2a70bf56c9967395ef7c7a5dd58a29cdf244aaa796dcc68