4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020

General

Target
4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Size 2.4MB
Sample260709-hdan8aew4y
SHA256 4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020
MD5 24d4eeabdd5686264c91c4c18b2ab0a2
SHA1 dc5c572b595d912a21bcc428aa6afbe9d49431a8
SHA512 1b669d186f9b77c232713f4c7a029e80989dd981a33aebe3c3ff1c66d1e805398125fdf1c6c3162ef8450205c6ea7830cc28877f783619017610dac0f97ce077
SSDEEP 49152:LlrCnS9mVb0Xq0oSj/6ln2/6wzqZpVj93DxmYGEsI0KDBnp:L4SwVb06ajw2SweZpVj9TxmpuJp
TLSH
T169C53387ABD1FAE5E82885F46E8848C04643DF5C842046F4FD9CBBB7EB418578A5C7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3880	Fix-WebView2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fix-WebView2.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeBackupPrivilege	1748	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Token: SeRestorePrivilege	1748	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Token: 33	1748	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Token: SeIncBasePriorityPrivilege	1748	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Token: 33	1748	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Token: SeIncBasePriorityPrivilege	1748	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Token: SeBackupPrivilege	3480	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Token: SeRestorePrivilege	3480	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Token: 33	3480	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
Token: SeIncBasePriorityPrivilege	3480	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3880	Fix-WebView2.exe
3880	Fix-WebView2.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 3480	1748	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe	84
PID 1748 wrote to memory of 3880	1748	4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe	85

C:\Users\Admin\AppData\Local\Temp\4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
"C:\Users\Admin\AppData\Local\Temp\4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\4dadb0dd039f692b0d975a770b28debcbdef013051f74c68fac20b4b3f99c020.exe
  PECMD**pecmd-cmd* @FILE -force "C:\Users\Admin\AppData\Local\Temp\~pecmd_devi.1748.0~.tmp.cab"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- C:\Users\Admin\AppData\Local\Temp\~8434163664243470089\Fix-WebView2.exe
  "C:\Users\Admin\AppData\Local\Temp\~8434163664243470089\Fix-WebView2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fix-WebView2.exe

Path C:\Users\Admin\AppData\Local\Temp\~8434163664243470089\Fix-WebView2.exe
Size 2.4MB
SHA256 7ea888f6218027db9c65de7dc138aee3c7e6cf39ac9a926397cde55634bf7dd8
MD5 f486020b64b1a8d3f0e113e8c8c4685f
SHA1 56067d50522b2044c54195ead636a344519f3bab
SHA512 ffca4750cdc4ea2dbfa13b74125064908ce70db6072bf7c420b43693eb48c6d8b2bced98c463feca4be55cb078a4a75f7514ef55d7d6fb075d1ba7eea0062a59
SSDEEP 49152:Gf5y83EiKXy+3n/URd7ygwxXXOMzrn7yOcIEjg0VonVlc:yA83EiKXyaC75wxXOMzr7yOAyVlc
TLSH
T182C5F111B6C280F1E672193004F697369E76FA164B34FBC79364EE2D5D322C1E63639A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~pecmd_devi.1748.0~.tmp.cab

Path C:\Users\Admin\AppData\Local\Temp\~pecmd_devi.1748.0~.tmp.cab
Size 1.8MB
SHA256 e7bbf2fbded6ff4048f8bd2de570c52ae9c06f1d6c1eb8ad5a110b46b8d2d4e2
MD5 fdf6013df1f21d453d403adfdd29ea7b
SHA1 923bfa00d7b463b689c8e8fe6cffa63df2993c4b
SHA512 d5bb694ad136537aa8a1a64880b7b15a55d70ce01813f59fb4a2daf18747c1a16856b399e3cadb7b9742da88a6ba405f77da2debefd9382b0d7135e73cfbde58
SSDEEP 49152:T0Xq0oSj/6ln2/6wzqZpVj93DxmYGEsI0KDBnl:T06ajw2SweZpVj9TxmpuJl
TLSH
T1EC95338BDED6F7ABFC4905D0AF4C48C05903DB58542046B5E78CA7A7DB4286BCB9C26C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1748-0-0x0000000140000000-0x0000000140365000-memory.dmp

Download

memory/1748-12-0x0000000140000000-0x0000000140365000-memory.dmp

Download

memory/3480-9-0x0000000140000000-0x0000000140365000-memory.dmp

Download

memory/3480-11-0x0000000140000000-0x0000000140365000-memory.dmp

Download

memory/3880-8-0x0000000000400000-0x000000000069F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads