a758307f99efa2393b67465d7c6ced79af45fd6524535a1f834fbe66ce589f33

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7ffa7a5805e151exeexeexeex.exe
Size

310KB
MD5

7ffa7a5805e151e2651a0b052f082da4
SHA1

c0fd128b3e3b7b56d0a6a582221033c4ab098d20
SHA256

a758307f99efa2393b67465d7c6ced79af45fd6524535a1f834fbe66ce589f33
SHA512

6d36619a6b7c3d1bcbc6e884b71e897e2a6614bea7c816855446bf792717f0bbd859b2498125ca3d73e91e2a18f5a7ce4f8574137c159fdb8ba0b881e32920e4
SSDEEP

6144:r2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDRe5v0k2+u:r2TFafJiHCWBWPMjVWrXfNk2B

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	7ffa7a5805e151exeexeexeex.exe

Executes dropped EXE 2 IoCs

pid	Process
5096	SearchIndexerDB.exe
3012	SearchIndexerDB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\ = "Application"	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\shell\open\command	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\shell\open	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\SearchIndexerDB.exe\" /START \"%1\" %*"	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\shell\runas	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\DefaultIcon\ = "%1"	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\Content-Type = "application/x-msdownload"	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\shell\runas\command\ = "\"%1\" %*"	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\open	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\DefaultIcon\ = "%1"	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\DefaultIcon	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\runas	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\SearchIndexerDB.exe\" /START \"%1\" %*"	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\runas\command	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\DefaultIcon	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*"	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\open\command	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\shell	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\shell\runas\command	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*"	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	7ffa7a5805e151exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\cmos	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\ = "cmos"	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\Content-Type = "application/x-msdownload"	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	7ffa7a5805e151exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	7ffa7a5805e151exeexeexeex.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5096	SearchIndexerDB.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 5096	3556	7ffa7a5805e151exeexeexeex.exe	87
PID 3556 wrote to memory of 5096	3556	7ffa7a5805e151exeexeexeex.exe	87
PID 3556 wrote to memory of 5096	3556	7ffa7a5805e151exeexeexeex.exe	87
PID 5096 wrote to memory of 3012	5096	SearchIndexerDB.exe	88
PID 5096 wrote to memory of 3012	5096	SearchIndexerDB.exe	88
PID 5096 wrote to memory of 3012	5096	SearchIndexerDB.exe	88

C:\Users\Admin\AppData\Local\Temp\7ffa7a5805e151exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\7ffa7a5805e151exeexeexeex.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\SearchIndexerDB.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\SearchIndexerDB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\SearchIndexerDB.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\SearchIndexerDB.exe"
    3⤵
    - Executes dropped EXE
    PID:3012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\SearchIndexerDB.exe

Filesize
310KB

MD5
95029739644011c9786ee662d0b5ecbb

SHA1
f93a0364f0458f02be221d9d010a35a3e5318aa0

SHA256
b4154e90937deffaa34c8ec0787bc366d673ecc9a0220300bd4faad55cb6af29

SHA512
d9c18bfe9b493e2d9b5aba9ddc232608c1ccd7cde4e88c712f927c4fc01b19d33b2f73f28651a746775910e59d334c54a2a017878af0381b6cfb2ba72cf66b2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\SearchIndexerDB.exe

Filesize
310KB

MD5
95029739644011c9786ee662d0b5ecbb

SHA1
f93a0364f0458f02be221d9d010a35a3e5318aa0

SHA256
b4154e90937deffaa34c8ec0787bc366d673ecc9a0220300bd4faad55cb6af29

SHA512
d9c18bfe9b493e2d9b5aba9ddc232608c1ccd7cde4e88c712f927c4fc01b19d33b2f73f28651a746775910e59d334c54a2a017878af0381b6cfb2ba72cf66b2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\SearchIndexerDB.exe

Filesize
310KB

MD5
95029739644011c9786ee662d0b5ecbb

SHA1
f93a0364f0458f02be221d9d010a35a3e5318aa0

SHA256
b4154e90937deffaa34c8ec0787bc366d673ecc9a0220300bd4faad55cb6af29

SHA512
d9c18bfe9b493e2d9b5aba9ddc232608c1ccd7cde4e88c712f927c4fc01b19d33b2f73f28651a746775910e59d334c54a2a017878af0381b6cfb2ba72cf66b2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\SearchIndexerDB.exe

Filesize
310KB

MD5
95029739644011c9786ee662d0b5ecbb

SHA1
f93a0364f0458f02be221d9d010a35a3e5318aa0

SHA256
b4154e90937deffaa34c8ec0787bc366d673ecc9a0220300bd4faad55cb6af29

SHA512
d9c18bfe9b493e2d9b5aba9ddc232608c1ccd7cde4e88c712f927c4fc01b19d33b2f73f28651a746775910e59d334c54a2a017878af0381b6cfb2ba72cf66b2f

Download Submit