Analysis
- max time kernel
101s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
19/06/2023, 14:36
General
- Target SecuriteInfo.com.Variant.Strictor.262459.11501.11584.exe
- Size 807KB
- Sample230619-ryj8tsff7s
- SHA256 055d1353e090b0ca79f1cada52c20eea97a86f452af07d9300fdc2d906dde98e
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Strictor.262459.11501.11584.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Strictor.262459.11501.11584.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Strictor.262459.11501.11584.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Strictor.262459.11501.11584.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Strictor.262459.11501.11584.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Strictor.262459.11501.11584.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Strictor.262459.11501.11584.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_nzal0hxb.qet.ps1
memory/716-173-0x0000000007210000-0x000000000722A000-memory.dmp
memory/716-159-0x0000000006ED0000-0x0000000006F02000-memory.dmp
memory/716-178-0x0000000007530000-0x0000000007538000-memory.dmp
memory/716-177-0x0000000007550000-0x000000000756A000-memory.dmp
memory/716-176-0x0000000007440000-0x000000000744E000-memory.dmp
memory/716-175-0x0000000007490000-0x0000000007526000-memory.dmp
memory/716-172-0x0000000007850000-0x0000000007ECA000-memory.dmp
memory/716-142-0x0000000004960000-0x0000000004996000-memory.dmp
memory/716-143-0x0000000004FD0000-0x00000000055F8000-memory.dmp
memory/716-144-0x0000000004F40000-0x0000000004F62000-memory.dmp
memory/716-158-0x0000000005EF0000-0x0000000005F0E000-memory.dmp
memory/716-145-0x0000000005830000-0x0000000005896000-memory.dmp
memory/716-156-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/716-151-0x0000000004950000-0x0000000004960000-memory.dmp
memory/716-171-0x0000000004950000-0x0000000004960000-memory.dmp
memory/716-170-0x00000000064E0000-0x00000000064FE000-memory.dmp
memory/716-174-0x0000000007280000-0x000000000728A000-memory.dmp
memory/716-160-0x0000000070AD0000-0x0000000070B1C000-memory.dmp
memory/1964-140-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1964-157-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1964-181-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1964-182-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1964-183-0x00000000017E0000-0x0000000001B2A000-memory.dmp
memory/3992-133-0x0000000000DA0000-0x0000000000E70000-memory.dmp
memory/3992-135-0x0000000005850000-0x00000000058E2000-memory.dmp
memory/3992-134-0x0000000005EB0000-0x0000000006454000-memory.dmp
memory/3992-139-0x0000000006A00000-0x0000000006A9C000-memory.dmp
memory/3992-138-0x0000000005A60000-0x0000000005A70000-memory.dmp
memory/3992-137-0x0000000005A60000-0x0000000005A70000-memory.dmp
memory/3992-136-0x0000000005820000-0x000000000582A000-memory.dmp