Analysis

  • max time kernel
    54s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2023, 13:07

General

  • Target

    file.exe

  • Size

    410KB

  • MD5

    e80264156b7c26f7495709faa23ffdb7

  • SHA1

    5d497c936ee71cc18125793bba524e4832a10789

  • SHA256

    aa4bbc0296b28232d20ca66e74e55dea3f82ca212db912fbc0825c93403654a9

  • SHA512

    697c7d64c1b8f07cede094aa6ace876dd9d3eac3c634036764eb464196e8a41ce3d93ff878d9e6b2cb0a5ea35a93aa123f75463f1571b38acd7e53ee1e4c5ec8

  • SSDEEP

    12288:9+cpD7KsRbSQ82gxVB5mSNDtdLCXZC/QuQ/g+LjQRohyqBoHCK0iOEfoh4c3QCNo:HpD0b

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:660
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe"
        2⤵
        • Checks computer location settings
        • Drops startup file
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Users\Admin\AppData\Local\830546.exe
          "C:\Users\Admin\AppData\Local\830546.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4836
        • C:\Users\Admin\AppData\Local\804548.exe
          "C:\Users\Admin\AppData\Local\804548.exe"
          3⤵
            PID:3680
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4668
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3108
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:1364
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:1372
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:3784
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:1636
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:1748
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3648
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4276
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2488
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1800
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-dc 0
            3⤵
              PID:3324
          • C:\Windows\System32\dialer.exe
            C:\Windows\System32\dialer.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1168
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qlgljmw#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3536

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\804548.exe

          Filesize

          3.6MB

          MD5

          0de1fdfdd47e717da35f524f6fe4e9d9

          SHA1

          caf0998abfb84e6d5599b9463e6209e16bd08322

          SHA256

          c07c051deedc1a23268fa2a3fa8eb0a233da0ef1c1d0421806d05bbf9161309d

          SHA512

          9f0f045042c2380c2a748098ead47f8c6323dedaed5e42d9174ca7e0b7c87d5219514c3f20dd1609c48c89f0e140699e38a65d9dce4d37ddc9616a011adfd94f

        • C:\Users\Admin\AppData\Local\804548.exe

          Filesize

          3.6MB

          MD5

          0de1fdfdd47e717da35f524f6fe4e9d9

          SHA1

          caf0998abfb84e6d5599b9463e6209e16bd08322

          SHA256

          c07c051deedc1a23268fa2a3fa8eb0a233da0ef1c1d0421806d05bbf9161309d

          SHA512

          9f0f045042c2380c2a748098ead47f8c6323dedaed5e42d9174ca7e0b7c87d5219514c3f20dd1609c48c89f0e140699e38a65d9dce4d37ddc9616a011adfd94f

        • C:\Users\Admin\AppData\Local\830546.exe

          Filesize

          9.9MB

          MD5

          9889b03f358c1e2a2635ae17eb4bf489

          SHA1

          3919276a8b72c4205512dd41ecf8c066bf721be0

          SHA256

          0c879e57aab759d1e31ba1ac2a03ffe1be3f44bd028a2dd4c597acec333b83d6

          SHA512

          ef9522066e646523c53249f788efdef9ac441087d8f6b6a5a56a2811f71cbf3b344be0f118bc9f3c12f62767d427736e5cab200c55ed66521170b3fc0ce31d6a

        • C:\Users\Admin\AppData\Local\830546.exe

          Filesize

          9.9MB

          MD5

          9889b03f358c1e2a2635ae17eb4bf489

          SHA1

          3919276a8b72c4205512dd41ecf8c066bf721be0

          SHA256

          0c879e57aab759d1e31ba1ac2a03ffe1be3f44bd028a2dd4c597acec333b83d6

          SHA512

          ef9522066e646523c53249f788efdef9ac441087d8f6b6a5a56a2811f71cbf3b344be0f118bc9f3c12f62767d427736e5cab200c55ed66521170b3fc0ce31d6a

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          101c3b86ef1c02c62b7d862c2a47363b

          SHA1

          3c5e8d309610e5ba41b6b9788bfb826e45864b46

          SHA256

          9174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c

          SHA512

          d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60

        • C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll

          Filesize

          384KB

          MD5

          55c797383dbbbfe93c0fe3215b99b8ec

          SHA1

          1b089157f3d8ae64c62ea15cdad3d82eafa1df4b

          SHA256

          5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d

          SHA512

          648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757

        • C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll

          Filesize

          384KB

          MD5

          55c797383dbbbfe93c0fe3215b99b8ec

          SHA1

          1b089157f3d8ae64c62ea15cdad3d82eafa1df4b

          SHA256

          5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d

          SHA512

          648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ith5nno.bxb.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\x86\SQLite.Interop.dll

          Filesize

          1.3MB

          MD5

          8be215abf1f36aa3d23555a671e7e3be

          SHA1

          547d59580b7843f90aaca238012a8a0c886330e6

          SHA256

          83f332ea9535814f18be4ee768682ecc7720794aedc30659eb165e46257a7cae

          SHA512

          38cf4aea676dacd2e719833ca504ac8751a5fe700214ff4ac2b77c0542928a6a1aa3780ed7418387affed67ab6be97f1439633249af22d62e075c1cdfdf5449b

        • memory/528-254-0x0000023461960000-0x0000023461987000-memory.dmp

          Filesize

          156KB

        • memory/528-256-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/528-278-0x0000023461960000-0x0000023461987000-memory.dmp

          Filesize

          156KB

        • memory/584-261-0x0000027490240000-0x0000027490267000-memory.dmp

          Filesize

          156KB

        • memory/584-226-0x0000027490210000-0x0000027490231000-memory.dmp

          Filesize

          132KB

        • memory/584-230-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/584-228-0x0000027490240000-0x0000027490267000-memory.dmp

          Filesize

          156KB

        • memory/664-231-0x00000268F8A00000-0x00000268F8A27000-memory.dmp

          Filesize

          156KB

        • memory/664-264-0x00000268F8A00000-0x00000268F8A27000-memory.dmp

          Filesize

          156KB

        • memory/664-235-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/944-245-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/944-237-0x0000023A0E9A0000-0x0000023A0E9C7000-memory.dmp

          Filesize

          156KB

        • memory/944-267-0x0000023A0E9A0000-0x0000023A0E9C7000-memory.dmp

          Filesize

          156KB

        • memory/964-265-0x000001A0852E0000-0x000001A085307000-memory.dmp

          Filesize

          156KB

        • memory/964-281-0x000001A0852E0000-0x000001A085307000-memory.dmp

          Filesize

          156KB

        • memory/964-269-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/1012-251-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/1012-272-0x000001D72E3C0000-0x000001D72E3E7000-memory.dmp

          Filesize

          156KB

        • memory/1012-246-0x000001D72E3C0000-0x000001D72E3E7000-memory.dmp

          Filesize

          156KB

        • memory/1032-271-0x0000020F2B5B0000-0x0000020F2B5D7000-memory.dmp

          Filesize

          156KB

        • memory/1032-275-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/1032-284-0x0000020F2B5B0000-0x0000020F2B5D7000-memory.dmp

          Filesize

          156KB

        • memory/1048-273-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/1048-270-0x0000017F13D00000-0x0000017F13D27000-memory.dmp

          Filesize

          156KB

        • memory/1048-283-0x0000017F13D00000-0x0000017F13D27000-memory.dmp

          Filesize

          156KB

        • memory/1136-285-0x000001F295F70000-0x000001F295F97000-memory.dmp

          Filesize

          156KB

        • memory/1136-276-0x000001F295F70000-0x000001F295F97000-memory.dmp

          Filesize

          156KB

        • memory/1136-280-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/1168-252-0x00007FF767820000-0x00007FF767849000-memory.dmp

          Filesize

          164KB

        • memory/1168-214-0x00007FF94DB70000-0x00007FF94DC2E000-memory.dmp

          Filesize

          760KB

        • memory/1168-212-0x00007FF94E850000-0x00007FF94EA45000-memory.dmp

          Filesize

          2.0MB

        • memory/1208-288-0x000001EEF1380000-0x000001EEF13A7000-memory.dmp

          Filesize

          156KB

        • memory/1208-289-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/1208-332-0x000001EEF1380000-0x000001EEF13A7000-memory.dmp

          Filesize

          156KB

        • memory/1264-336-0x0000018408E70000-0x0000018408E97000-memory.dmp

          Filesize

          156KB

        • memory/1264-290-0x0000018408E70000-0x0000018408E97000-memory.dmp

          Filesize

          156KB

        • memory/1264-292-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/1272-296-0x0000024D112A0000-0x0000024D112C7000-memory.dmp

          Filesize

          156KB

        • memory/1272-297-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/1272-341-0x0000024D112A0000-0x0000024D112C7000-memory.dmp

          Filesize

          156KB

        • memory/1324-345-0x00000181AD600000-0x00000181AD627000-memory.dmp

          Filesize

          156KB

        • memory/1324-301-0x00000181AD600000-0x00000181AD627000-memory.dmp

          Filesize

          156KB

        • memory/1324-304-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/1388-349-0x0000022EE0A00000-0x0000022EE0A27000-memory.dmp

          Filesize

          156KB

        • memory/1388-306-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

          Filesize

          64KB

        • memory/1388-302-0x0000022EE0A00000-0x0000022EE0A27000-memory.dmp

          Filesize

          156KB

        • memory/1404-353-0x000001F353FB0000-0x000001F353FD7000-memory.dmp

          Filesize

          156KB

        • memory/1404-305-0x000001F353FB0000-0x000001F353FD7000-memory.dmp

          Filesize

          156KB

        • memory/3536-260-0x00000172A81F0000-0x00000172A8200000-memory.dmp

          Filesize

          64KB

        • memory/3536-255-0x00000172A81F0000-0x00000172A8200000-memory.dmp

          Filesize

          64KB

        • memory/4668-203-0x000001F5B3230000-0x000001F5B3240000-memory.dmp

          Filesize

          64KB

        • memory/4668-207-0x000001F5B3230000-0x000001F5B3240000-memory.dmp

          Filesize

          64KB

        • memory/4668-202-0x000001F5B3240000-0x000001F5B3262000-memory.dmp

          Filesize

          136KB

        • memory/4836-236-0x00007FF7FB9A0000-0x00007FF7FC399000-memory.dmp

          Filesize

          10.0MB

        • memory/4964-133-0x0000000000170000-0x00000000001DC000-memory.dmp

          Filesize

          432KB

        • memory/4964-134-0x0000000002660000-0x000000000267A000-memory.dmp

          Filesize

          104KB

        • memory/4964-135-0x0000000005170000-0x0000000005714000-memory.dmp

          Filesize

          5.6MB

        • memory/4964-136-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

          Filesize

          64KB

        • memory/4964-145-0x0000000005EC0000-0x0000000005F52000-memory.dmp

          Filesize

          584KB

        • memory/4964-146-0x0000000005E20000-0x0000000005E32000-memory.dmp

          Filesize

          72KB

        • memory/4964-147-0x0000000006230000-0x00000000063F2000-memory.dmp

          Filesize

          1.8MB

        • memory/4964-151-0x00000000066F0000-0x0000000006752000-memory.dmp

          Filesize

          392KB

        • memory/4964-157-0x00000000077E0000-0x000000000781C000-memory.dmp

          Filesize

          240KB

        • memory/4964-168-0x0000000007A00000-0x0000000007A76000-memory.dmp

          Filesize

          472KB

        • memory/4964-169-0x0000000007A80000-0x0000000007AE6000-memory.dmp

          Filesize

          408KB

        • memory/4964-170-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

          Filesize

          64KB

        • memory/4964-174-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

          Filesize

          64KB

        • memory/4964-177-0x000000000A6C0000-0x000000000A6DE000-memory.dmp

          Filesize

          120KB

        • memory/4964-184-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

          Filesize

          64KB