Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2023 17:47
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
fc1c010b776b3e094b556982ff729d5f.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
-
Target
fc1c010b776b3e094b556982ff729d5f.exe
-
Size
1.3MB
-
MD5
fc1c010b776b3e094b556982ff729d5f
-
SHA1
762794ee4b573f011664d872dc9de42d636fac5d
-
SHA256
e40b3da6d63897102a14d6d17128ccdfe8d774db9b7481b89e1269e38113d786
-
SHA512
3065a910e09ee7682853e4f97769a4302799214b514bae0bd1c79399eb97d16b457ad775e12b085105326555c64b0af01707dcf16be9fd11b1294b3424c8f09e
-
SSDEEP
24576:btb20pkaCqT5TBWgNQ7a/PHbGinldnpLeMluAQ16AK:YVg5tQ7a/P7Gil1W5K
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.fr.url fc1c010b776b3e094b556982ff729d5f.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini RegAsm.exe File created C:\Windows\assembly\Desktop.ini RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4496 set thread context of 1476 4496 fc1c010b776b3e094b556982ff729d5f.exe 91 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini RegAsm.exe File opened for modification C:\Windows\assembly RegAsm.exe File created C:\Windows\assembly\Desktop.ini RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4496 fc1c010b776b3e094b556982ff729d5f.exe 4496 fc1c010b776b3e094b556982ff729d5f.exe 4496 fc1c010b776b3e094b556982ff729d5f.exe 4496 fc1c010b776b3e094b556982ff729d5f.exe 4496 fc1c010b776b3e094b556982ff729d5f.exe 4496 fc1c010b776b3e094b556982ff729d5f.exe 1476 RegAsm.exe 1476 RegAsm.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1476 RegAsm.exe 2284 Taskmgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4496 fc1c010b776b3e094b556982ff729d5f.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1476 RegAsm.exe Token: 33 1476 RegAsm.exe Token: SeIncBasePriorityPrivilege 1476 RegAsm.exe Token: SeDebugPrivilege 2284 Taskmgr.exe Token: SeSystemProfilePrivilege 2284 Taskmgr.exe Token: SeCreateGlobalPrivilege 2284 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe 2284 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1476 RegAsm.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4496 wrote to memory of 1476 4496 fc1c010b776b3e094b556982ff729d5f.exe 91 PID 4496 wrote to memory of 1476 4496 fc1c010b776b3e094b556982ff729d5f.exe 91 PID 4496 wrote to memory of 1476 4496 fc1c010b776b3e094b556982ff729d5f.exe 91 PID 4496 wrote to memory of 1476 4496 fc1c010b776b3e094b556982ff729d5f.exe 91 PID 1476 wrote to memory of 2284 1476 RegAsm.exe 95 PID 1476 wrote to memory of 2284 1476 RegAsm.exe 95 PID 1476 wrote to memory of 2284 1476 RegAsm.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc1c010b776b3e094b556982ff729d5f.exe"C:\Users\Admin\AppData\Local\Temp\fc1c010b776b3e094b556982ff729d5f.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\fc1c010b776b3e094b556982ff729d5f.exe"2⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2284
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
321KB
MD5e88090a663169843bfdfb896c079d39f
SHA1e9a9996b2bd00395d0b66fed8787c822ac12586d
SHA2561fe400eab095e4cce09a63bba9837b023ff938909f7f45122fd755a1ea34ff62
SHA5128be247280610f3ea8fb2ae8a8d4cd4f3c26df973afdd54dea4b36f7b2fc17f8a6448c79c31fd27ce033b880794ddefbc610fca69e48edc81d35418057b383253