0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4

General

Target

0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
Size

2.8MB
MD5

f72fd582902f5f15cf9ba14f7c6a2145
SHA1

fb08b0fdbd7457cda3224055faa39976f2b694a9
SHA256

0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4
SHA512

21bb83954c77c5ce8b21f5c4be86a2f56c6ca19c821876d5bc6616aea0bea8436006de6b39b90e68f8ecabb813474a9df7518aec8d4030cc8a83a017bb001fd3
SSDEEP

49152:8YwByTIjy6l9DrMgUVz7Mny53NHuoINYN0RxvYXHK9/CmK/Qqat57/GL:g26l9DrMgUVhPU7WKsmWat5iL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe

Executes dropped EXE 1 IoCs

pid	Process
1048	VSSTAT.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1048	VSSTAT.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1048	VSSTAT.EXE
1048	VSSTAT.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
Token: SeDebugPrivilege	1048	VSSTAT.EXE
Token: SeManageVolumePrivilege	1248	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2272	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
2272	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
1048	VSSTAT.EXE
1048	VSSTAT.EXE
1048	VSSTAT.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1048	2272	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe	87
PID 2272 wrote to memory of 1048	2272	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe	87
PID 2272 wrote to memory of 1048	2272	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe	87

C:\Users\Admin\AppData\Local\Temp\0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
"C:\Users\Admin\AppData\Local\Temp\0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\VSSTAT.EXE
  "C:\Users\Admin\AppData\Local\Temp\VSSTAT.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1048

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240622109\....\VSSTAT.EXE

Filesize
2.8MB

MD5
2b524cbc83bfee2e666a9dd39df865e9

SHA1
721f0c23cc5f06a9771286d214586f31e721e295

SHA256
bb3abc90ed7fa3ca00cd1bb6d989c26e101d97879a456e5184b0c051d955f399

SHA512
62ada0931410b003feb76d9886b7ecdace8d11ab32ac840676ace921a4831540fffcb405aa3209e4dc23db636373507cd632666de44cf329da5c7db29ec22a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\VSSTAT.EXE

Filesize
2.8MB

MD5
2b524cbc83bfee2e666a9dd39df865e9

SHA1
721f0c23cc5f06a9771286d214586f31e721e295

SHA256
bb3abc90ed7fa3ca00cd1bb6d989c26e101d97879a456e5184b0c051d955f399

SHA512
62ada0931410b003feb76d9886b7ecdace8d11ab32ac840676ace921a4831540fffcb405aa3209e4dc23db636373507cd632666de44cf329da5c7db29ec22a4d

Download Submit
memory/1048-8-0x00000000778E4000-0x00000000778E5000-memory.dmp

Filesize
4KB

Download
memory/1248-48-0x0000020116CC0000-0x0000020116CC1000-memory.dmp

Filesize
4KB

Download
memory/1248-50-0x0000020116CC0000-0x0000020116CC1000-memory.dmp

Filesize
4KB

Download
memory/1248-41-0x0000020116C90000-0x0000020116C91000-memory.dmp

Filesize
4KB

Download
memory/1248-42-0x0000020116CC0000-0x0000020116CC1000-memory.dmp

Filesize
4KB

Download
memory/1248-43-0x0000020116CC0000-0x0000020116CC1000-memory.dmp

Filesize
4KB

Download
memory/1248-44-0x0000020116CC0000-0x0000020116CC1000-memory.dmp

Filesize
4KB

Download
memory/1248-45-0x0000020116CC0000-0x0000020116CC1000-memory.dmp

Filesize
4KB

Download
memory/1248-46-0x0000020116CC0000-0x0000020116CC1000-memory.dmp

Filesize
4KB

Download
memory/1248-47-0x0000020116CC0000-0x0000020116CC1000-memory.dmp

Filesize
4KB

Download
memory/1248-9-0x000002010E5A0000-0x000002010E5B0000-memory.dmp

Filesize
64KB

Download
memory/1248-49-0x0000020116CC0000-0x0000020116CC1000-memory.dmp

Filesize
4KB

Download
memory/1248-25-0x000002010E6A0000-0x000002010E6B0000-memory.dmp

Filesize
64KB

Download
memory/1248-51-0x0000020116CC0000-0x0000020116CC1000-memory.dmp

Filesize
4KB

Download
memory/1248-52-0x00000201168E0000-0x00000201168E1000-memory.dmp

Filesize
4KB

Download
memory/1248-53-0x00000201168D0000-0x00000201168D1000-memory.dmp

Filesize
4KB

Download
memory/1248-55-0x00000201168E0000-0x00000201168E1000-memory.dmp

Filesize
4KB

Download
memory/1248-58-0x00000201168D0000-0x00000201168D1000-memory.dmp

Filesize
4KB

Download
memory/1248-61-0x0000020116810000-0x0000020116811000-memory.dmp

Filesize
4KB

Download
memory/1248-73-0x0000020116A10000-0x0000020116A11000-memory.dmp

Filesize
4KB

Download
memory/1248-75-0x0000020116A20000-0x0000020116A21000-memory.dmp

Filesize
4KB

Download
memory/1248-76-0x0000020116A20000-0x0000020116A21000-memory.dmp

Filesize
4KB

Download
memory/1248-77-0x0000020116B30000-0x0000020116B31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing