4a198ba14bc25b19e72904912b77e409a75983c052641982e9018f59b4cd1a5c

Analysis

max time kernel
147s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/03/2025, 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

whatsapp.exe
Size

456KB
MD5

163ef3af02c67e5f0412014ab7fd2586
SHA1

fb4be138b14afd8a45b811bc5a96725cf34a383e
SHA256

128a0deafd45973bc66de28dc0771ea9c51a0e3b24c2d9ed37569f5f7f905093
SHA512

f4bcc35f52532283a8046a0c1c4fbabb3239a6cac59da922fef31a0a697edd82cd5b589ef7179381511a7344c1b4939bb7b668a25316c7e3ce7ad5a2b727810d
SSDEEP

6144:tbIUuRgSqk1l+4Hb4I2HIEi+nPHawj6gwIRlzLzjzB8Q5LlKTWKnHe1yvsaA/:tbHu1+C4Is7zrvzWQ5LlKTWKnHmyvs1

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\whatsapp.exe = "C:\\Users\\Admin\\AppData\\Roaming\\whatsapp.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\whatsapp.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\whatsapp.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	whatsapp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\whatsaap = "C:\\Users\\Admin\\AppData\\Roaming\\whatsapp.exe"	whatsapp.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\whatsaap = "C:\\Users\\Admin\\AppData\\Roaming\\whatsapp.exe"	whatsapp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\whatsaap = "C:\\Users\\Admin\\AppData\\Roaming\\whatsapp.exe"	whatsapp.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whatsapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2568	reg.exe
2768	reg.exe
2664	reg.exe
2844	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	2164	whatsapp.exe
Token: SeCreateTokenPrivilege	2164	whatsapp.exe
Token: SeAssignPrimaryTokenPrivilege	2164	whatsapp.exe
Token: SeLockMemoryPrivilege	2164	whatsapp.exe
Token: SeIncreaseQuotaPrivilege	2164	whatsapp.exe
Token: SeMachineAccountPrivilege	2164	whatsapp.exe
Token: SeTcbPrivilege	2164	whatsapp.exe
Token: SeSecurityPrivilege	2164	whatsapp.exe
Token: SeTakeOwnershipPrivilege	2164	whatsapp.exe
Token: SeLoadDriverPrivilege	2164	whatsapp.exe
Token: SeSystemProfilePrivilege	2164	whatsapp.exe
Token: SeSystemtimePrivilege	2164	whatsapp.exe
Token: SeProfSingleProcessPrivilege	2164	whatsapp.exe
Token: SeIncBasePriorityPrivilege	2164	whatsapp.exe
Token: SeCreatePagefilePrivilege	2164	whatsapp.exe
Token: SeCreatePermanentPrivilege	2164	whatsapp.exe
Token: SeBackupPrivilege	2164	whatsapp.exe
Token: SeRestorePrivilege	2164	whatsapp.exe
Token: SeShutdownPrivilege	2164	whatsapp.exe
Token: SeDebugPrivilege	2164	whatsapp.exe
Token: SeAuditPrivilege	2164	whatsapp.exe
Token: SeSystemEnvironmentPrivilege	2164	whatsapp.exe
Token: SeChangeNotifyPrivilege	2164	whatsapp.exe
Token: SeRemoteShutdownPrivilege	2164	whatsapp.exe
Token: SeUndockPrivilege	2164	whatsapp.exe
Token: SeSyncAgentPrivilege	2164	whatsapp.exe
Token: SeEnableDelegationPrivilege	2164	whatsapp.exe
Token: SeManageVolumePrivilege	2164	whatsapp.exe
Token: SeImpersonatePrivilege	2164	whatsapp.exe
Token: SeCreateGlobalPrivilege	2164	whatsapp.exe
Token: 31	2164	whatsapp.exe
Token: 32	2164	whatsapp.exe
Token: 33	2164	whatsapp.exe
Token: 34	2164	whatsapp.exe
Token: 35	2164	whatsapp.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2164	whatsapp.exe
2164	whatsapp.exe
2164	whatsapp.exe
2164	whatsapp.exe
2164	whatsapp.exe
2164	whatsapp.exe
2164	whatsapp.exe
2164	whatsapp.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2640	2164	whatsapp.exe	30
PID 2164 wrote to memory of 2640	2164	whatsapp.exe	30
PID 2164 wrote to memory of 2640	2164	whatsapp.exe	30
PID 2164 wrote to memory of 2640	2164	whatsapp.exe	30
PID 2164 wrote to memory of 372	2164	whatsapp.exe	31
PID 2164 wrote to memory of 372	2164	whatsapp.exe	31
PID 2164 wrote to memory of 372	2164	whatsapp.exe	31
PID 2164 wrote to memory of 372	2164	whatsapp.exe	31
PID 2164 wrote to memory of 2728	2164	whatsapp.exe	32
PID 2164 wrote to memory of 2728	2164	whatsapp.exe	32
PID 2164 wrote to memory of 2728	2164	whatsapp.exe	32
PID 2164 wrote to memory of 2728	2164	whatsapp.exe	32
PID 2164 wrote to memory of 2744	2164	whatsapp.exe	33
PID 2164 wrote to memory of 2744	2164	whatsapp.exe	33
PID 2164 wrote to memory of 2744	2164	whatsapp.exe	33
PID 2164 wrote to memory of 2744	2164	whatsapp.exe	33
PID 2728 wrote to memory of 2768	2728	cmd.exe	39
PID 2728 wrote to memory of 2768	2728	cmd.exe	39
PID 2728 wrote to memory of 2768	2728	cmd.exe	39
PID 2728 wrote to memory of 2768	2728	cmd.exe	39
PID 2744 wrote to memory of 2664	2744	cmd.exe	38
PID 2744 wrote to memory of 2664	2744	cmd.exe	38
PID 2744 wrote to memory of 2664	2744	cmd.exe	38
PID 2744 wrote to memory of 2664	2744	cmd.exe	38
PID 372 wrote to memory of 2568	372	cmd.exe	40
PID 372 wrote to memory of 2568	372	cmd.exe	40
PID 372 wrote to memory of 2568	372	cmd.exe	40
PID 372 wrote to memory of 2568	372	cmd.exe	40
PID 2640 wrote to memory of 2844	2640	cmd.exe	41
PID 2640 wrote to memory of 2844	2640	cmd.exe	41
PID 2640 wrote to memory of 2844	2640	cmd.exe	41
PID 2640 wrote to memory of 2844	2640	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\whatsapp.exe
"C:\Users\Admin\AppData\Local\Temp\whatsapp.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\whatsapp.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\whatsapp.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\whatsapp.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\whatsapp.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\whatsapp.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\whatsapp.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\whatsapp.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\whatsapp.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2664