e7ebc6c68a23bfb0d6f9d46c14b27b03f4aaeaafbcec81418f10f3bc190d523d

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2023, 21:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0016739c32ff1b375e9bf3008a56991.exe
Size 1.8MB
Sample230514-1m63wsdf85
SHA256 e7ebc6c68a23bfb0d6f9d46c14b27b03f4aaeaafbcec81418f10f3bc190d523d
MD5 f0016739c32ff1b375e9bf3008a56991
SHA1 c6f1ed811bdcd9c39f0fefbd53af0ee3b693a59b
SHA512 1c1367828d3bc051aa60c6d764a29ad0e864de649e23943d5c52a354cfd9a7f2de6452359c3f8fbccb34e5af060d99b93b8860f51cc371804548725fab856d73
SSDEEP 49152:INyYP8XVYvxSb1efaWqHnLJECyjUqldcOR:INyI8FRndHn5QKOR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	f0016739c32ff1b375e9bf3008a56991.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 748 set thread context of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2764	powershell.exe
2764	powershell.exe
748	f0016739c32ff1b375e9bf3008a56991.exe
748	f0016739c32ff1b375e9bf3008a56991.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	748	f0016739c32ff1b375e9bf3008a56991.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2764	748	f0016739c32ff1b375e9bf3008a56991.exe	84
PID 748 wrote to memory of 2764	748	f0016739c32ff1b375e9bf3008a56991.exe	84
PID 748 wrote to memory of 2764	748	f0016739c32ff1b375e9bf3008a56991.exe	84
PID 748 wrote to memory of 3164	748	f0016739c32ff1b375e9bf3008a56991.exe	92
PID 748 wrote to memory of 3164	748	f0016739c32ff1b375e9bf3008a56991.exe	92
PID 748 wrote to memory of 3164	748	f0016739c32ff1b375e9bf3008a56991.exe	92
PID 748 wrote to memory of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93
PID 748 wrote to memory of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93
PID 748 wrote to memory of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93
PID 748 wrote to memory of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93
PID 748 wrote to memory of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93
PID 748 wrote to memory of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93
PID 748 wrote to memory of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93
PID 748 wrote to memory of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93
PID 748 wrote to memory of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93
PID 748 wrote to memory of 3744	748	f0016739c32ff1b375e9bf3008a56991.exe	93

C:\Users\Admin\AppData\Local\Temp\f0016739c32ff1b375e9bf3008a56991.exe
"C:\Users\Admin\AppData\Local\Temp\f0016739c32ff1b375e9bf3008a56991.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\f0016739c32ff1b375e9bf3008a56991.exe
  C:\Users\Admin\AppData\Local\Temp\f0016739c32ff1b375e9bf3008a56991.exe
  2⤵
  PID:3164
- C:\Users\Admin\AppData\Local\Temp\f0016739c32ff1b375e9bf3008a56991.exe
  C:\Users\Admin\AppData\Local\Temp\f0016739c32ff1b375e9bf3008a56991.exe
  2⤵
  PID:3744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_euyehjmm.xm5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_euyehjmm.xm5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/748-134-0x00000000058E0000-0x0000000005E84000-memory.dmp

Download

memory/748-135-0x0000000005210000-0x00000000052A2000-memory.dmp

Download

memory/748-136-0x00000000051F0000-0x00000000051FA000-memory.dmp

Download

memory/748-137-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/748-138-0x0000000006E70000-0x0000000006E92000-memory.dmp

Download

memory/748-158-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/748-133-0x0000000000790000-0x0000000000954000-memory.dmp

Download

memory/2764-146-0x0000000005D10000-0x0000000005D76000-memory.dmp

Download

memory/2764-139-0x0000000004D80000-0x0000000004DB6000-memory.dmp

Download

memory/2764-143-0x0000000005C30000-0x0000000005C96000-memory.dmp

Download

memory/2764-141-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/2764-140-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/2764-154-0x0000000006320000-0x000000000633E000-memory.dmp

Download

memory/2764-155-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/2764-156-0x0000000007BA0000-0x000000000821A000-memory.dmp

Download

memory/2764-157-0x0000000006840000-0x000000000685A000-memory.dmp

Download

memory/2764-142-0x0000000005430000-0x0000000005A58000-memory.dmp

Download

memory/2764-159-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/2764-160-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/2764-161-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/3744-165-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/3744-167-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/3744-168-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/3744-170-0x0000000000400000-0x0000000000437000-memory.dmp

Download