Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 01:26
Static task
static1
Behavioral task
behavioral1
Sample
35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe
Resource
win10v2004-20230220-en
General
-
Target
35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe
-
Size
899KB
-
MD5
c011326ff5f864290617144c3dddcc88
-
SHA1
257d10e95aeec5d8c63e4d1369c5cbf244568bf7
-
SHA256
35bc2054162c7288b55caecc386d129b5b03e2a97985f659913338195be78491
-
SHA512
894e43a4265c396b0721ea3fb99991047cc33aa36fc9f2f8fb47c5f66813a8226589b8ed045a1edc2279654cf3b933f413a434cf42f1fcd11f52ff3d6bd2a07a
-
SSDEEP
12288:qeU8P7AlfzNA1Na+tIHBvD0hECB8dIxZZeyAnE/sTZ32jQnQeH//WmrHcjhS:q8Cf0a+6ghEC7XV+8Qnjf/WmTGhS
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe -
Executes dropped EXE 1 IoCs
pid Process 208 microsafte.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1616 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4708 timeout.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe Token: SeDebugPrivilege 208 microsafte.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3628 wrote to memory of 3600 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 89 PID 3628 wrote to memory of 3600 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 89 PID 3628 wrote to memory of 3600 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 89 PID 3628 wrote to memory of 3992 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 90 PID 3628 wrote to memory of 3992 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 90 PID 3628 wrote to memory of 3992 3628 35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe 90 PID 3992 wrote to memory of 4708 3992 cmd.exe 93 PID 3992 wrote to memory of 4708 3992 cmd.exe 93 PID 3992 wrote to memory of 4708 3992 cmd.exe 93 PID 3600 wrote to memory of 1616 3600 cmd.exe 94 PID 3600 wrote to memory of 1616 3600 cmd.exe 94 PID 3600 wrote to memory of 1616 3600 cmd.exe 94 PID 3992 wrote to memory of 208 3992 cmd.exe 95 PID 3992 wrote to memory of 208 3992 cmd.exe 95 PID 3992 wrote to memory of 208 3992 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe"C:\Users\Admin\AppData\Local\Temp\35BC2054162C7288B55CAECC386D129B5B03E2A97985F.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 35BC2054162C7288B55CAECC386D129B5B03E2A97985F /tr '"C:\Users\Admin\AppData\Roaming\microsafte.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 35BC2054162C7288B55CAECC386D129B5B03E2A97985F /tr '"C:\Users\Admin\AppData\Roaming\microsafte.exe"'3⤵
- Creates scheduled task(s)
PID:1616
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC009.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4708
-
-
C:\Users\Admin\AppData\Roaming\microsafte.exe"C:\Users\Admin\AppData\Roaming\microsafte.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154B
MD526976e8e5aefac0a1bf0c90b8c471069
SHA1e43de325e4c9b4f82fb512b8a8857c5dcee557c3
SHA2568b5b78b519db60af171a76229361b14e67e6d6280ab450f154f439759ed9f1f8
SHA512f4cd1b31ea5cd8c1d5d872580a064f6cec31eec87ea0eaef013090e210ddc96c481dbb6ff521c817933dac3db6c1a44b620de9422c664505ce4cd5daf402bad6
-
Filesize
899KB
MD5c011326ff5f864290617144c3dddcc88
SHA1257d10e95aeec5d8c63e4d1369c5cbf244568bf7
SHA25635bc2054162c7288b55caecc386d129b5b03e2a97985f659913338195be78491
SHA512894e43a4265c396b0721ea3fb99991047cc33aa36fc9f2f8fb47c5f66813a8226589b8ed045a1edc2279654cf3b933f413a434cf42f1fcd11f52ff3d6bd2a07a
-
Filesize
899KB
MD5c011326ff5f864290617144c3dddcc88
SHA1257d10e95aeec5d8c63e4d1369c5cbf244568bf7
SHA25635bc2054162c7288b55caecc386d129b5b03e2a97985f659913338195be78491
SHA512894e43a4265c396b0721ea3fb99991047cc33aa36fc9f2f8fb47c5f66813a8226589b8ed045a1edc2279654cf3b933f413a434cf42f1fcd11f52ff3d6bd2a07a