7417c092b97809415e22e0956a66956b508dad8c42c49c627c4f4e777f8dbc50

Analysis

max time kernel
120s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8.exe
Size

386KB
MD5

f9bb6ef02f29f52ff126279ff7d044bb
SHA1

5b68f1745d92d32a1e64ef3ace6640c5fbfeb254
SHA256

2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8
SHA512

86a6c71dca30b5a6dc54cdc262318bbae1f16ba5f3e701d6d84adf8ddda265d178ddf7b72753e491a46d4fe043c2b7f9919f1be25a6f4fa0bc72ad193b0ca153
SSDEEP

3072:H1sSJApTSnQU/x0ImhuDzHfs4zbYOjujDRfygDgKQINXLLHIaKlay8weCycJ5DfS:H1sSmRIt/xhtsOju1DH5NXnIKAc

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2460 powershell.exe

pid	process
2460	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8.exe

Executes dropped EXE 2 IoCs

Processes:

Svchost.exeSystem32.exe

pid process

2236 Svchost.exe
4748 System32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

System32.exepowershell.exe

pid process

4748 System32.exe
2460 powershell.exe
2460 powershell.exe

pid	process
2236	Svchost.exe
4748	System32.exe

pid	process
4748	System32.exe
2460	powershell.exe
2460	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

System32.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4748	System32.exe
Token: SeIncreaseQuotaPrivilege	4748	System32.exe
Token: SeSecurityPrivilege	4748	System32.exe
Token: SeTakeOwnershipPrivilege	4748	System32.exe
Token: SeLoadDriverPrivilege	4748	System32.exe
Token: SeSystemProfilePrivilege	4748	System32.exe
Token: SeSystemtimePrivilege	4748	System32.exe
Token: SeProfSingleProcessPrivilege	4748	System32.exe
Token: SeIncBasePriorityPrivilege	4748	System32.exe
Token: SeCreatePagefilePrivilege	4748	System32.exe
Token: SeBackupPrivilege	4748	System32.exe
Token: SeRestorePrivilege	4748	System32.exe
Token: SeShutdownPrivilege	4748	System32.exe
Token: SeDebugPrivilege	4748	System32.exe
Token: SeSystemEnvironmentPrivilege	4748	System32.exe
Token: SeRemoteShutdownPrivilege	4748	System32.exe
Token: SeUndockPrivilege	4748	System32.exe
Token: SeManageVolumePrivilege	4748	System32.exe
Token: 33	4748	System32.exe
Token: 34	4748	System32.exe
Token: 35	4748	System32.exe
Token: 36	4748	System32.exe
Token: SeDebugPrivilege	2460	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8.exe

description	pid	process	target process
PID 1148 wrote to memory of 2236	1148	2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8.exe	Svchost.exe
PID 1148 wrote to memory of 2236	1148	2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8.exe	Svchost.exe
PID 1148 wrote to memory of 4748	1148	2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8.exe	System32.exe
PID 1148 wrote to memory of 4748	1148	2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8.exe	System32.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8.exe
"C:\Users\Admin\AppData\Local\Temp\2f175dac5c8571e586722f6927b0112af22637a17efb3acfd78e813a804a38f8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1148

C:\ProgramData\Svchost.exe
"C:\ProgramData\Svchost.exe"
2⤵
- Executes dropped EXE
PID:2236

C:\ProgramData\System32.exe
"C:\ProgramData\System32.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -File C:\Users\Public\updates.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft.Win32.TaskScheduler.dll
Filesize
326KB

MD5
a844ac745a4005fbd3f51d79ff88583c

SHA1
92671774fd4be9781a77d2788a8dddbf8981ead5

SHA256
74fe1a6a1e36be7d893e31bbb4d4bd83bf4b927e715276cd5607982139818ebd

SHA512
5f0734058d9146ffeb552abf443df5097cf134a4737bed499467830e08d97f5d1996c1f1647c5c12289ca4d4209effd480010afebc59d50290d4ca7d45bb41f8

Download Submit
C:\ProgramData\Svchost.exe
Filesize
330KB

MD5
bdd3d30ea4bc94d1240ea75f1aa212eb

SHA1
f994ffb94690263047c5227cc8b65d3ab3345ba7

SHA256
00b7a0f1b18c5dd1f4d469a8c6997198fd7f471e94d6a6ba70d79fd165f44888

SHA512
3a039b360581d7d2204dfff546d08b2a5ec36d78f9572730d9a707fe35925c8451d505fbb19f9c9d9861f3e5aea9ae4b52ae0031e109721d57f55a62b1b691b8

Download Submit
C:\ProgramData\System32.exe
Filesize
51KB

MD5
f52616c47b243f3373248ed2a5f49e1c

SHA1
d601cad06d6ccb0e52dabe8d34ae5f1cfd463000

SHA256
3b24abf5671a93c15eca052fd28555e561dfe625962b2dbe733d7f717467a3a8

SHA512
9435df5be1594667eaa988115b8d712abb0766e0e90330d2fa99ce76cfdc6272cb65a6c922278bb265c8e2127e755f5aadbfa2481ee009f105ff222d12f07cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dbjvobet.hxe.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\updates.ps1
Filesize
43KB

MD5
d9a4b64d20c6860f12b6da0ecd53983a

SHA1
b3e8c9479370807c009bfb8ba46566a3e3e0893d

SHA256
2e5ddfeff91ad3ba0ea2446912cef3b7f2b905cb3eb9f3d3ea51f512a13b53ad

SHA512
10afb3130e4fb0af1a4efb618ed70f017fde98091927dd23a82fb8c228ea78b1ea6b1b644e4c2d733e21d8f152ec89fac11938d1d9ec38558a8319922ee2e6b3

Download Submit
memory/1148-1-0x0000000000F60000-0x0000000000FC6000-memory.dmp

Filesize
408KB

Download
memory/1148-0-0x00007FF841563000-0x00007FF841565000-memory.dmp

Filesize
8KB

Download
memory/2236-15-0x0000000000260000-0x00000000002B8000-memory.dmp

Filesize
352KB

Download
memory/2236-34-0x00007FF841560000-0x00007FF842021000-memory.dmp

Filesize
10.8MB

Download
memory/2236-61-0x00007FF841560000-0x00007FF842021000-memory.dmp

Filesize
10.8MB

Download
memory/4748-29-0x00000000000C0000-0x00000000000D4000-memory.dmp

Filesize
80KB

Download
memory/4748-45-0x00000000021E0000-0x0000000002202000-memory.dmp

Filesize
136KB

Download
memory/4748-31-0x00000000020B0000-0x0000000002108000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads