Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2023 18:09
Static task
static1
General
-
Target
file.exe
-
Size
456KB
-
MD5
a8145015691ccb73460a69fa0a8b0304
-
SHA1
d1f61cd7ccf682868720dacfc91f50ce4e70412b
-
SHA256
eff416f17b83327e6911308b2b9678f52fb4b4d20b99a96f43c2478e5dcc10f2
-
SHA512
246c43e235fa7c5b4ec9575dd68448db19b28532f5bb51b3baa9b3637a990f25c3677b54fc40d47bd0ced5e97fb10dbe0a04e0df5516f9ca24a5bf47fb2a78f1
-
SSDEEP
6144:I1/tBaOZZfURQrLmwCn/2L04fiOFnZitWpqdc6WwjLC6a2HEZ+rG7tUW:mtbRURQ+wC+9KtWpqSNg+6RrqtUW
Malware Config
Signatures
-
Processes:
file.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe -
Processes:
file.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0" file.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\International\Geo\Nation file.exe -
Drops startup file 1 IoCs
Processes:
AddInProcess32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GYrXVyMZ39P34L6aPCny49nn.bat AddInProcess32.exe -
Processes:
file.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths file.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\file.exe = "0" file.exe -
Processes:
file.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 3672 set thread context of 1148 3672 file.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
file.exepowershell.exepid process 3672 file.exe 3672 file.exe 1692 powershell.exe 1692 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
file.exeAddInProcess32.exepowershell.exedescription pid process Token: SeDebugPrivilege 3672 file.exe Token: SeDebugPrivilege 1148 AddInProcess32.exe Token: SeDebugPrivilege 1692 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
file.exedescription pid process target process PID 3672 wrote to memory of 1692 3672 file.exe powershell.exe PID 3672 wrote to memory of 1692 3672 file.exe powershell.exe PID 3672 wrote to memory of 1692 3672 file.exe powershell.exe PID 3672 wrote to memory of 3696 3672 file.exe CasPol.exe PID 3672 wrote to memory of 3696 3672 file.exe CasPol.exe PID 3672 wrote to memory of 3696 3672 file.exe CasPol.exe PID 3672 wrote to memory of 1148 3672 file.exe AddInProcess32.exe PID 3672 wrote to memory of 1148 3672 file.exe AddInProcess32.exe PID 3672 wrote to memory of 1148 3672 file.exe AddInProcess32.exe PID 3672 wrote to memory of 1148 3672 file.exe AddInProcess32.exe PID 3672 wrote to memory of 1148 3672 file.exe AddInProcess32.exe PID 3672 wrote to memory of 1148 3672 file.exe AddInProcess32.exe PID 3672 wrote to memory of 1148 3672 file.exe AddInProcess32.exe PID 3672 wrote to memory of 1148 3672 file.exe AddInProcess32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
file.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tpfqrqvm.qvv.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\Pictures\d21xVVTc7kT5LzeQrIGn9rOc.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
memory/1148-10-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1148-74-0x0000000004700000-0x0000000004710000-memory.dmpFilesize
64KB
-
memory/1148-73-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/1148-16-0x0000000004700000-0x0000000004710000-memory.dmpFilesize
64KB
-
memory/1148-12-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/1692-31-0x00000000055E0000-0x0000000005646000-memory.dmpFilesize
408KB
-
memory/1692-35-0x00000000046B0000-0x00000000046C0000-memory.dmpFilesize
64KB
-
memory/1692-61-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/1692-58-0x00000000071E0000-0x00000000071E8000-memory.dmpFilesize
32KB
-
memory/1692-13-0x0000000000C80000-0x0000000000CB6000-memory.dmpFilesize
216KB
-
memory/1692-57-0x0000000007200000-0x000000000721A000-memory.dmpFilesize
104KB
-
memory/1692-15-0x00000000046B0000-0x00000000046C0000-memory.dmpFilesize
64KB
-
memory/1692-56-0x0000000007100000-0x0000000007114000-memory.dmpFilesize
80KB
-
memory/1692-55-0x00000000070F0000-0x00000000070FE000-memory.dmpFilesize
56KB
-
memory/1692-17-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/1692-19-0x0000000004CF0000-0x0000000005318000-memory.dmpFilesize
6.2MB
-
memory/1692-18-0x00000000046B0000-0x00000000046C0000-memory.dmpFilesize
64KB
-
memory/1692-54-0x00000000070C0000-0x00000000070D1000-memory.dmpFilesize
68KB
-
memory/1692-25-0x0000000005410000-0x0000000005432000-memory.dmpFilesize
136KB
-
memory/1692-30-0x00000000056C0000-0x0000000005726000-memory.dmpFilesize
408KB
-
memory/1692-53-0x0000000007140000-0x00000000071D6000-memory.dmpFilesize
600KB
-
memory/1692-32-0x0000000005740000-0x0000000005A94000-memory.dmpFilesize
3.3MB
-
memory/1692-33-0x0000000005B90000-0x0000000005BAE000-memory.dmpFilesize
120KB
-
memory/1692-34-0x0000000005BC0000-0x0000000005C0C000-memory.dmpFilesize
304KB
-
memory/1692-52-0x0000000006F30000-0x0000000006F3A000-memory.dmpFilesize
40KB
-
memory/1692-36-0x000000007FCA0000-0x000000007FCB0000-memory.dmpFilesize
64KB
-
memory/1692-37-0x0000000006190000-0x00000000061C2000-memory.dmpFilesize
200KB
-
memory/1692-38-0x0000000070210000-0x000000007025C000-memory.dmpFilesize
304KB
-
memory/1692-48-0x0000000006150000-0x000000000616E000-memory.dmpFilesize
120KB
-
memory/1692-49-0x0000000006B90000-0x0000000006C33000-memory.dmpFilesize
652KB
-
memory/1692-50-0x0000000007500000-0x0000000007B7A000-memory.dmpFilesize
6.5MB
-
memory/1692-51-0x0000000006EC0000-0x0000000006EDA000-memory.dmpFilesize
104KB
-
memory/3672-8-0x0000000005000000-0x000000000501E000-memory.dmpFilesize
120KB
-
memory/3672-0-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/3672-4-0x0000000004DB0000-0x0000000004DCA000-memory.dmpFilesize
104KB
-
memory/3672-5-0x0000000004F80000-0x0000000004FF6000-memory.dmpFilesize
472KB
-
memory/3672-14-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/3672-6-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/3672-7-0x0000000004F20000-0x0000000004F2A000-memory.dmpFilesize
40KB
-
memory/3672-9-0x00000000051C0000-0x00000000051E6000-memory.dmpFilesize
152KB
-
memory/3672-3-0x0000000004E30000-0x0000000004EC2000-memory.dmpFilesize
584KB
-
memory/3672-2-0x00000000054B0000-0x0000000005A54000-memory.dmpFilesize
5.6MB
-
memory/3672-1-0x00000000003B0000-0x0000000000428000-memory.dmpFilesize
480KB