Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-01-2025 01:39
Static task
static1
Behavioral task
behavioral1
Sample
839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe
Resource
win10v2004-20241007-en
General
-
Target
839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe
-
Size
577KB
-
MD5
7feb51850825988c38dc04f30f3ac501
-
SHA1
cb76c0fce19210fcfaed4e1cb9fb6ecb4a317eff
-
SHA256
839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14
-
SHA512
086637fe339e52b75920c115c7c9b57895509d605a81e206776fb25b9f8049f0cddad4a4b0cc9b3aa4f6c14ada28ff2a52264fa4170be0f169ac8e4a5fe57ee0
-
SSDEEP
12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb7b:rBJwdhMJ6ZzHrfcsMGTfZ5Pb
Malware Config
Signatures
-
Imminent family
-
Executes dropped EXE 1 IoCs
pid Process 1688 Webfrequency.exe -
Loads dropped DLL 1 IoCs
pid Process 2668 839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webdevelop = "C:\\Users\\Admin\\AppData\\Roaming\\Webdevelop\\Webfrequency.exe" 839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1688 set thread context of 2020 1688 Webfrequency.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Webfrequency.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2020 RegAsm.exe Token: 33 2020 RegAsm.exe Token: SeIncBasePriorityPrivilege 2020 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2020 RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2668 wrote to memory of 1688 2668 839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe 31 PID 2668 wrote to memory of 1688 2668 839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe 31 PID 2668 wrote to memory of 1688 2668 839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe 31 PID 2668 wrote to memory of 1688 2668 839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe 31 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32 PID 1688 wrote to memory of 2020 1688 Webfrequency.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe"C:\Users\Admin\AppData\Local\Temp\839244b5b58786fe44993973e74acc27def318d2461cb52dc30612766e857e14.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD5dc372045c60199d8ff2f9bb210d4ef1f
SHA15c29dd4afe29a2b5855be4c54e9e3348ab00c229
SHA2569f33359bb91cd0d8efc37905aa27e48feace6d6fc8984542c7224f6e7cf77f2b
SHA512fb774220b29ab51d56ae56dfc8a00808876947374d5afe8f47f698a757cd2260d6a473a3b26a18c3065c937af390db648c698b9a74c5a2452b71f4009336e548