Analysis

  • max time kernel
    96s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 09:09 UTC

General

  • Target

    3fa2a14ecf5b341310532e04423c9bf8cf806bcdb3feecd9f37f3b8257ccf27b.exe

  • Size

    2.6MB

  • MD5

    f0097b227864c351f73bf62041d3f7b7

  • SHA1

    10fc7e924a039f258931621c4387772bc53854b8

  • SHA256

    3fa2a14ecf5b341310532e04423c9bf8cf806bcdb3feecd9f37f3b8257ccf27b

  • SHA512

    a7fd0878afd89b3edfdeb6ea310d7fc2206dfb9ba7ac5329947bc24a33945273fde9d9d5a4be4ac1f9867eb01d61ce43fcc55017a70eb2d793bda87f449ca6ea

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlZ:86SIROiFJiwp0xlrlZ

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fa2a14ecf5b341310532e04423c9bf8cf806bcdb3feecd9f37f3b8257ccf27b.exe
    "C:\Users\Admin\AppData\Local\Temp\3fa2a14ecf5b341310532e04423c9bf8cf806bcdb3feecd9f37f3b8257ccf27b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Users\Admin\AppData\Local\Temp\3fa2a14ecf5b341310532e04423c9bf8cf806bcdb3feecd9f37f3b8257ccf27b.exe
      "C:\Users\Admin\AppData\Local\Temp\3fa2a14ecf5b341310532e04423c9bf8cf806bcdb3feecd9f37f3b8257ccf27b.exe"
      2⤵
      • Drops startup file
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:116
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:528
        • C:\Users\Admin\AppData\Local\Temp\3fa2a14ecf5b341310532e04423c9bf8cf806bcdb3feecd9f37f3b8257ccf27b.exe
          "C:\Users\Admin\AppData\Local\Temp\3fa2a14ecf5b341310532e04423c9bf8cf806bcdb3feecd9f37f3b8257ccf27b.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:456
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:3988

      Network

      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        88.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.210.23.2.in-addr.arpa
        IN PTR
        Response
        88.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-88deploystaticakamaitechnologiescom
      • flag-us
        DNS
        140.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        140.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        58.55.71.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        58.55.71.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        197.87.175.4.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        197.87.175.4.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        133.130.81.91.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.130.81.91.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        43.229.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.229.111.52.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 8.8.8.8:53
        88.210.23.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        88.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        140.32.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        140.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        58.55.71.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        58.55.71.13.in-addr.arpa

      • 8.8.8.8:53
        197.87.175.4.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        197.87.175.4.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        133.130.81.91.in-addr.arpa
        dns
        72 B
        147 B
        1
        1

        DNS Request

        133.130.81.91.in-addr.arpa

      • 8.8.8.8:53
        43.229.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        43.229.111.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\Parameters.ini

        Filesize

        74B

        MD5

        6687785d6a31cdf9a5f80acb3abc459b

        SHA1

        1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

        SHA256

        3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

        SHA512

        5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

      • memory/116-3-0x0000000000400000-0x00000000005D3000-memory.dmp

        Filesize

        1.8MB

      • memory/116-4-0x0000000000400000-0x00000000005D3000-memory.dmp

        Filesize

        1.8MB

      • memory/116-5-0x0000000000400000-0x00000000005D3000-memory.dmp

        Filesize

        1.8MB

      • memory/116-6-0x0000000000400000-0x00000000005D3000-memory.dmp

        Filesize

        1.8MB

      • memory/116-7-0x0000000000400000-0x00000000005D3000-memory.dmp

        Filesize

        1.8MB

      • memory/116-58-0x0000000000400000-0x00000000005D3000-memory.dmp

        Filesize

        1.8MB

      • memory/116-68-0x0000000000400000-0x00000000005D3000-memory.dmp

        Filesize

        1.8MB

      • memory/456-61-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/456-62-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/456-70-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/4888-2-0x0000000000407000-0x0000000000408000-memory.dmp

        Filesize

        4KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.