Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 01:30
Static task
static1
Behavioral task
behavioral1
Sample
Falcon.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Falcon.exe
Resource
win10v2004-20240426-en
General
-
Target
Falcon.exe
-
Size
2.1MB
-
MD5
005e76ae2d3af2cc2a001745d5e0afd9
-
SHA1
fa117b48f316b38db20887ba9b0138a07d686064
-
SHA256
a427b998ac966b5f8a4ec510205b075cfe7eaa102ac1d9e1ac0182a54cb33d2c
-
SHA512
2e5bb3e7d95230c012014184bb29ddbd56328fc8d63738ebf50923d5e86461d2f2511c32ca930d23eeec81b4a0d4ad54a4be0c782dfe01904a276a74636a1e8b
-
SSDEEP
49152:ftBEvg4rSx4YYKOvp+QoqkxR/NPmmRFyxGFrEN0FN63lSY:fQvg4G6YDxQoqkxBNPXmUylD
Malware Config
Extracted
bitrat
1.38
23.105.131.195:49645
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Falcon.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation Falcon.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Falcon.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ntuser = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ntuser.exe\"" Falcon.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
Falcon.exepid process 7060 Falcon.exe 7060 Falcon.exe 7060 Falcon.exe 7060 Falcon.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Falcon.exedescription pid process target process PID 4540 set thread context of 7060 4540 Falcon.exe Falcon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
Falcon.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings Falcon.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Falcon.exepowershell.exepid process 4540 Falcon.exe 4540 Falcon.exe 7100 powershell.exe 7100 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Falcon.exepowershell.exeFalcon.exedescription pid process Token: SeDebugPrivilege 4540 Falcon.exe Token: SeDebugPrivilege 7100 powershell.exe Token: SeShutdownPrivilege 7060 Falcon.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Falcon.exepid process 7060 Falcon.exe 7060 Falcon.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Falcon.exeWScript.exedescription pid process target process PID 4540 wrote to memory of 6924 4540 Falcon.exe WScript.exe PID 4540 wrote to memory of 6924 4540 Falcon.exe WScript.exe PID 4540 wrote to memory of 6924 4540 Falcon.exe WScript.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 4540 wrote to memory of 7060 4540 Falcon.exe Falcon.exe PID 6924 wrote to memory of 7100 6924 WScript.exe powershell.exe PID 6924 wrote to memory of 7100 6924 WScript.exe powershell.exe PID 6924 wrote to memory of 7100 6924 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Falcon.exe"C:\Users\Admin\AppData\Local\Temp\Falcon.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Lvzjypcn.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Ntuser.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Falcon.exeC:\Users\Admin\AppData\Local\Temp\Falcon.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_Lvzjypcn.vbsFilesize
136B
MD524131be6e84c424a31423a9daa683b01
SHA138ae56938aa4fd963f066287b4190c929388e074
SHA2561fe2a89a827cbe4ef046ca27f4d38c1ef1fbe889901f3946a4b7e1d4005cbde7
SHA5125e0cb79ec9ed8836570393060e0b0f55b1a1a0446922e988913ed4ea4d67567a3a04e7d3a77c73dce596bd0eae530d07f0d2cf0f9cdf6b96001e1737d158704f
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0rixae2v.pit.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/4540-10-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-5-0x0000000074530000-0x0000000074CE0000-memory.dmpFilesize
7.7MB
-
memory/4540-2-0x0000000005900000-0x0000000005EA4000-memory.dmpFilesize
5.6MB
-
memory/4540-3-0x0000000005260000-0x00000000052F2000-memory.dmpFilesize
584KB
-
memory/4540-0-0x000000007453E000-0x000000007453F000-memory.dmpFilesize
4KB
-
memory/4540-60-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-6-0x000000007453E000-0x000000007453F000-memory.dmpFilesize
4KB
-
memory/4540-7-0x0000000006B90000-0x0000000006D9A000-memory.dmpFilesize
2.0MB
-
memory/4540-8-0x0000000004CB0000-0x0000000004D1A000-memory.dmpFilesize
424KB
-
memory/4540-24-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-72-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-70-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-69-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-66-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-62-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-58-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-54-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-50-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-46-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-44-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-40-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-36-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-34-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-32-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-30-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-28-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-26-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-22-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-20-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-18-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-16-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-14-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-12-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-64-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-56-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-1-0x0000000000660000-0x000000000087C000-memory.dmpFilesize
2.1MB
-
memory/4540-4-0x0000000005310000-0x000000000531A000-memory.dmpFilesize
40KB
-
memory/4540-52-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-48-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-42-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-38-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-9-0x0000000004CB0000-0x0000000004D13000-memory.dmpFilesize
396KB
-
memory/4540-1823-0x0000000074530000-0x0000000074CE0000-memory.dmpFilesize
7.7MB
-
memory/4540-1834-0x0000000074530000-0x0000000074CE0000-memory.dmpFilesize
7.7MB
-
memory/7060-1877-0x0000000074440000-0x0000000074479000-memory.dmpFilesize
228KB
-
memory/7060-1895-0x00000000747C0000-0x00000000747F9000-memory.dmpFilesize
228KB
-
memory/7060-1885-0x00000000747C0000-0x00000000747F9000-memory.dmpFilesize
228KB
-
memory/7060-1892-0x00000000747C0000-0x00000000747F9000-memory.dmpFilesize
228KB
-
memory/7060-1889-0x00000000747C0000-0x00000000747F9000-memory.dmpFilesize
228KB
-
memory/7060-1886-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/7060-1833-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/7100-1835-0x0000000002A70000-0x0000000002AA6000-memory.dmpFilesize
216KB
-
memory/7100-1868-0x0000000007930000-0x00000000079C6000-memory.dmpFilesize
600KB
-
memory/7100-1850-0x0000000006370000-0x000000000638E000-memory.dmpFilesize
120KB
-
memory/7100-1866-0x00000000076A0000-0x00000000076BA000-memory.dmpFilesize
104KB
-
memory/7100-1853-0x00000000703D0000-0x000000007041C000-memory.dmpFilesize
304KB
-
memory/7100-1864-0x00000000073A0000-0x0000000007443000-memory.dmpFilesize
652KB
-
memory/7100-1849-0x0000000005E90000-0x00000000061E4000-memory.dmpFilesize
3.3MB
-
memory/7100-1838-0x0000000005C80000-0x0000000005CE6000-memory.dmpFilesize
408KB
-
memory/7100-1851-0x0000000006420000-0x000000000646C000-memory.dmpFilesize
304KB
-
memory/7100-1865-0x0000000007CE0000-0x000000000835A000-memory.dmpFilesize
6.5MB
-
memory/7100-1867-0x0000000007700000-0x000000000770A000-memory.dmpFilesize
40KB
-
memory/7100-1837-0x0000000005BE0000-0x0000000005C02000-memory.dmpFilesize
136KB
-
memory/7100-1869-0x00000000078A0000-0x00000000078B1000-memory.dmpFilesize
68KB
-
memory/7100-1870-0x00000000078D0000-0x00000000078DE000-memory.dmpFilesize
56KB
-
memory/7100-1871-0x00000000078E0000-0x00000000078F4000-memory.dmpFilesize
80KB
-
memory/7100-1839-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/7100-1836-0x0000000005560000-0x0000000005B88000-memory.dmpFilesize
6.2MB
-
memory/7100-1852-0x0000000006940000-0x0000000006972000-memory.dmpFilesize
200KB
-
memory/7100-1863-0x0000000007380000-0x000000000739E000-memory.dmpFilesize
120KB
-
memory/7100-1873-0x0000000007920000-0x0000000007928000-memory.dmpFilesize
32KB
-
memory/7100-1872-0x00000000079F0000-0x0000000007A0A000-memory.dmpFilesize
104KB