Analysis

  • max time kernel
    68s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:25

General

  • Target

    34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe

  • Size

    580KB

  • MD5

    8cfc3f50d92b1919d85306fa26d53a73

  • SHA1

    9bcdae674f2508df2e9c98fe441d4e0fa9bb85e4

  • SHA256

    34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4

  • SHA512

    04c62010776379fb46f90081db7cc4040ccaae373610475088fd891bc487d8e3a4c7396d73a1941538c398bd639b04d1e9cd0271ed596eaa80cd2b62162dff55

  • SSDEEP

    12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb7J:rBJwdhMJ6ZzHrfcsMGTfZ5PJ

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:6056
    • C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe
      "C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"
      2⤵
        PID:652
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:5448

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe

        Filesize

        580KB

        MD5

        390450fa0f4df04359cfabdbfd4c1b39

        SHA1

        49cfc47174ced44a65164084a6dc09f7f2378a73

        SHA256

        0f792dc91ebc5e62240503627348f40276075367acc75179c9ea35b01f679b0c

        SHA512

        f6e50aeb33daf4ae35c536162083f41ca187ca470e398b3645b2b4770a6d93a95eea82afc2a0c7fc3514f250c20a9081fea86162832ac604cbbf20b7a773e490

      • memory/652-28-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB

      • memory/652-26-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB

      • memory/652-25-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB

      • memory/652-22-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB

      • memory/652-24-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB

      • memory/6056-6-0x0000000005350000-0x000000000535A000-memory.dmp

        Filesize

        40KB

      • memory/6056-7-0x000000007503E000-0x000000007503F000-memory.dmp

        Filesize

        4KB

      • memory/6056-8-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB

      • memory/6056-4-0x0000000005360000-0x000000000536A000-memory.dmp

        Filesize

        40KB

      • memory/6056-23-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB

      • memory/6056-5-0x0000000075030000-0x00000000757E0000-memory.dmp

        Filesize

        7.7MB

      • memory/6056-0-0x000000007503E000-0x000000007503F000-memory.dmp

        Filesize

        4KB

      • memory/6056-3-0x0000000005290000-0x0000000005322000-memory.dmp

        Filesize

        584KB

      • memory/6056-2-0x00000000057A0000-0x0000000005D44000-memory.dmp

        Filesize

        5.6MB

      • memory/6056-1-0x0000000000820000-0x00000000008B4000-memory.dmp

        Filesize

        592KB