Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2023, 20:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe
Resource
win7-20230831-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe
-
Size
399KB
-
MD5
7b3f7614fedcec2f47b38f3967f47aef
-
SHA1
0d5b8f38c9c2a2aaffd8337839d64350c7acb41e
-
SHA256
bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2
-
SHA512
12da78f689fd51819fc10fd4039b756bb89f37e87a1b4c678f2e278d81277fbf75e8fe4b981c7a1cd22ecc821259e4fdd6119dd8491b67b239c1b2a45e48f1b3
-
SSDEEP
6144:qKiYJL+K7EQ5vrt5AVfL8haEK4sDzLPFocEOkCybEaQRXr9HNdvOa:WqEU0Vf4ha0sDzoOkx2LIa
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3184 created 620 3184 Explorer.EXE 4 -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\DWZgTyTd.sys xcopy.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe -
Executes dropped EXE 2 IoCs
pid Process 1388 1980d59 920 xcopy.exe -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 Destination IP 223.5.5.5 -
Drops file in System32 directory 26 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1980d59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1980d59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A 1980d59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4 1980d59 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 xcopy.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 xcopy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1980d59 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C xcopy.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 xcopy.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B xcopy.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475 xcopy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1980d59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1980d59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1980d59 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C xcopy.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475 xcopy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1980d59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E 1980d59 File created C:\Windows\SysWOW64\1980d59 bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1980d59 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A 1980d59 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B xcopy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DED9969D7ED2C6E555C5C9254A43EDE4 1980d59 File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 xcopy.exe File created C:\Windows\system32\ \Windows\System32\CPeM8jSsx.sys xcopy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E 1980d59 -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\17c358 1980d59 File created C:\Windows\Inf\xcopy.exe Explorer.EXE File opened for modification C:\Windows\Inf\xcopy.exe Explorer.EXE File created C:\Windows\CSQkIkf.sys xcopy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName xcopy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 xcopy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 xcopy.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 208 timeout.exe 3804 timeout.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1980d59 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing xcopy.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" xcopy.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" xcopy.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1980d59 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1980d59 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1980d59 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix xcopy.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" xcopy.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ xcopy.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1980d59 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1980d59 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" xcopy.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1980d59 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" xcopy.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" xcopy.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1980d59 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1980d59 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 1388 1980d59 3184 Explorer.EXE 3184 Explorer.EXE 3184 Explorer.EXE 3184 Explorer.EXE 1388 1980d59 1388 1980d59 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe 920 xcopy.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3184 Explorer.EXE -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 4780 bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe Token: SeTcbPrivilege 4780 bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe Token: SeDebugPrivilege 1388 1980d59 Token: SeTcbPrivilege 1388 1980d59 Token: SeDebugPrivilege 1388 1980d59 Token: SeDebugPrivilege 3184 Explorer.EXE Token: SeDebugPrivilege 3184 Explorer.EXE Token: SeIncBasePriorityPrivilege 4780 bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe Token: SeDebugPrivilege 1388 1980d59 Token: SeDebugPrivilege 920 xcopy.exe Token: SeDebugPrivilege 920 xcopy.exe Token: SeDebugPrivilege 920 xcopy.exe Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeIncBasePriorityPrivilege 1388 1980d59 Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3184 Explorer.EXE 3184 Explorer.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1388 wrote to memory of 3184 1388 1980d59 45 PID 1388 wrote to memory of 3184 1388 1980d59 45 PID 1388 wrote to memory of 3184 1388 1980d59 45 PID 1388 wrote to memory of 3184 1388 1980d59 45 PID 1388 wrote to memory of 3184 1388 1980d59 45 PID 3184 wrote to memory of 920 3184 Explorer.EXE 84 PID 3184 wrote to memory of 920 3184 Explorer.EXE 84 PID 3184 wrote to memory of 920 3184 Explorer.EXE 84 PID 3184 wrote to memory of 920 3184 Explorer.EXE 84 PID 3184 wrote to memory of 920 3184 Explorer.EXE 84 PID 3184 wrote to memory of 920 3184 Explorer.EXE 84 PID 3184 wrote to memory of 920 3184 Explorer.EXE 84 PID 1388 wrote to memory of 620 1388 1980d59 4 PID 1388 wrote to memory of 620 1388 1980d59 4 PID 1388 wrote to memory of 620 1388 1980d59 4 PID 1388 wrote to memory of 620 1388 1980d59 4 PID 1388 wrote to memory of 620 1388 1980d59 4 PID 4780 wrote to memory of 1164 4780 bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe 86 PID 4780 wrote to memory of 1164 4780 bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe 86 PID 4780 wrote to memory of 1164 4780 bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe 86 PID 1164 wrote to memory of 208 1164 cmd.exe 88 PID 1164 wrote to memory of 208 1164 cmd.exe 88 PID 1164 wrote to memory of 208 1164 cmd.exe 88 PID 1388 wrote to memory of 4616 1388 1980d59 89 PID 1388 wrote to memory of 4616 1388 1980d59 89 PID 1388 wrote to memory of 4616 1388 1980d59 89 PID 4616 wrote to memory of 3804 4616 cmd.exe 91 PID 4616 wrote to memory of 3804 4616 cmd.exe 91 PID 4616 wrote to memory of 3804 4616 cmd.exe 91
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Windows\Inf\xcopy.exe"C:\Windows\Inf\xcopy.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe"C:\Users\Admin\AppData\Local\Temp\bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\bf6b65610b30d30cf1809513c2a04fa1827ddc9d89cb6ee8c1bdbd96259711a2.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
PID:208
-
-
-
-
C:\Windows\Syswow64\1980d59C:\Windows\Syswow64\1980d591⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\1980d59"2⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\timeout.exetimeout /t 13⤵
- Delays execution with timeout.exe
PID:3804
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.5MB
MD56697f78c0dffa2e0b851046aaf272101
SHA1b91aeb9e6d4d99778a4fe27da2457cdb321e8bfe
SHA256354b9545fbb292faea96eadbef7c85caf0f6f72b915e567044833fdfc2b923f0
SHA512fd5d44c6aa0c791e77bfec1436e810b1ef6cd1c92937faa060b6688b5dd4a47268189639e628e2fed8ce57ad04b0e816f18b16d2a3e69e60cbd16049948766d4
-
Filesize
49KB
MD539fbfd3af58238c6f9d4d408c9251ff5
SHA1c5bd7815ed18f7e3d1ce93cc47aecf58d908dca8
SHA256269eb0728413654856f4b2ee1fa7838cd69672ebc11baed4caa63f58c2df5823
SHA512b1cf7952f4c5d049c6bf076a34aba5789833ef208c3e8ab1de300d96c9e7ffcfd13e0b458ff608105395b57cec7fe0f2dd240c942e9e727e13bf5686c752e336
-
Filesize
49KB
MD539fbfd3af58238c6f9d4d408c9251ff5
SHA1c5bd7815ed18f7e3d1ce93cc47aecf58d908dca8
SHA256269eb0728413654856f4b2ee1fa7838cd69672ebc11baed4caa63f58c2df5823
SHA512b1cf7952f4c5d049c6bf076a34aba5789833ef208c3e8ab1de300d96c9e7ffcfd13e0b458ff608105395b57cec7fe0f2dd240c942e9e727e13bf5686c752e336
-
Filesize
399KB
MD5d0c59d5efe234ab425e0f6f8b852caf3
SHA19579606bb2c4e6146b5d62eea02ad63f0c5e3a89
SHA256fc04c0fa8efaf79016a0109190b62bd0d8a9db472ddac50331afe3af8824eee1
SHA512db95e030d0fca83b239519308bfec32e626b3abefab29c4ff7a72de73962ace898766a4b4cd7f7fd6cf9d3060e0015419e44b63819ff158e0c9c151f6f315555
-
Filesize
399KB
MD5d0c59d5efe234ab425e0f6f8b852caf3
SHA19579606bb2c4e6146b5d62eea02ad63f0c5e3a89
SHA256fc04c0fa8efaf79016a0109190b62bd0d8a9db472ddac50331afe3af8824eee1
SHA512db95e030d0fca83b239519308bfec32e626b3abefab29c4ff7a72de73962ace898766a4b4cd7f7fd6cf9d3060e0015419e44b63819ff158e0c9c151f6f315555