Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 23:15
Static task
static1
Behavioral task
behavioral1
Sample
429ac1a806b4fcdc9bf44ea6987f94f6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
429ac1a806b4fcdc9bf44ea6987f94f6.exe
Resource
win10v2004-20231215-en
General
-
Target
429ac1a806b4fcdc9bf44ea6987f94f6.exe
-
Size
123KB
-
MD5
429ac1a806b4fcdc9bf44ea6987f94f6
-
SHA1
8e4bb6295d40c6f19aab7c47cca3d945747d41e4
-
SHA256
24e6a700c2676fa3c1979958e16c0fa8dbd9fb818dba822cdf7ce001c1a68043
-
SHA512
50dbab8769fc80ec291d338390dc3d6ea080ebd969a7cac47d23afcce4f9183b6ffbc0d5ad4a35191ea6300c60d501515f574feee47741c70bd09acce72685b4
-
SSDEEP
3072:Lf3nTY/Afey9FpatoPnprvFFE3sHX2qawogX48:rT68ey9utonprOe2q
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\19C1AD.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
429ac1a806b4fcdc9bf44ea6987f94f6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 429ac1a806b4fcdc9bf44ea6987f94f6.exe -
Executes dropped EXE 2 IoCs
Processes:
SfZdz.execvtres.exepid process 3300 SfZdz.exe 1464 cvtres.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
429ac1a806b4fcdc9bf44ea6987f94f6.exedescription ioc process File opened for modification C:\Windows\assembly\Desktop.ini 429ac1a806b4fcdc9bf44ea6987f94f6.exe File created C:\Windows\assembly\Desktop.ini 429ac1a806b4fcdc9bf44ea6987f94f6.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
cvtres.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum cvtres.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 cvtres.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SfZdz.exedescription pid process target process PID 3300 set thread context of 1464 3300 SfZdz.exe cvtres.exe -
Drops file in Windows directory 3 IoCs
Processes:
429ac1a806b4fcdc9bf44ea6987f94f6.exedescription ioc process File created C:\Windows\assembly\Desktop.ini 429ac1a806b4fcdc9bf44ea6987f94f6.exe File opened for modification C:\Windows\assembly\Desktop.ini 429ac1a806b4fcdc9bf44ea6987f94f6.exe File opened for modification C:\Windows\assembly 429ac1a806b4fcdc9bf44ea6987f94f6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SfZdz.exepid process 3300 SfZdz.exe 3300 SfZdz.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
cvtres.exepid process 1464 cvtres.exe 1464 cvtres.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SfZdz.exedescription pid process Token: SeDebugPrivilege 3300 SfZdz.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
429ac1a806b4fcdc9bf44ea6987f94f6.exeSfZdz.execvtres.exedescription pid process target process PID 1052 wrote to memory of 3300 1052 429ac1a806b4fcdc9bf44ea6987f94f6.exe SfZdz.exe PID 1052 wrote to memory of 3300 1052 429ac1a806b4fcdc9bf44ea6987f94f6.exe SfZdz.exe PID 1052 wrote to memory of 3300 1052 429ac1a806b4fcdc9bf44ea6987f94f6.exe SfZdz.exe PID 3300 wrote to memory of 1464 3300 SfZdz.exe cvtres.exe PID 3300 wrote to memory of 1464 3300 SfZdz.exe cvtres.exe PID 3300 wrote to memory of 1464 3300 SfZdz.exe cvtres.exe PID 3300 wrote to memory of 1464 3300 SfZdz.exe cvtres.exe PID 3300 wrote to memory of 1464 3300 SfZdz.exe cvtres.exe PID 3300 wrote to memory of 1464 3300 SfZdz.exe cvtres.exe PID 1464 wrote to memory of 3160 1464 cvtres.exe svchost.exe PID 1464 wrote to memory of 3160 1464 cvtres.exe svchost.exe PID 1464 wrote to memory of 3160 1464 cvtres.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\429ac1a806b4fcdc9bf44ea6987f94f6.exe"C:\Users\Admin\AppData\Local\Temp\429ac1a806b4fcdc9bf44ea6987f94f6.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\SfZdz.exe"C:\Users\Admin\AppData\Local\Temp\SfZdz.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
-
C:\Users\Admin\AppData\Local\Temp\cvtres.exeC:\Users\Admin\AppData\Local\Temp\\cvtres.exe1⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Adds policy Run key to start application
PID:3160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SfZdz.exeFilesize
77KB
MD52b0653fd5eca2b3b2c62a11beb3529f1
SHA197ded9593b80038976ef9f4f5360ec173476508d
SHA25635b8cea3645e9478855787160752e5feb62156d5780213db82fe96a17a7534e5
SHA512cdba35b21c95eaacefe770ee7537a07d4893e39a34ee594f367363d774eed1c9b2ddd834459934d81f93c763eea57ec9df084ea2bfa978c17c5b5e2ab42bb5e2
-
C:\Users\Admin\AppData\Local\Temp\cvtres.exeFilesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
memory/1052-1-0x0000000075180000-0x0000000075731000-memory.dmpFilesize
5.7MB
-
memory/1052-2-0x0000000000BE0000-0x0000000000BF0000-memory.dmpFilesize
64KB
-
memory/1052-21-0x0000000075180000-0x0000000075731000-memory.dmpFilesize
5.7MB
-
memory/1052-0-0x0000000075180000-0x0000000075731000-memory.dmpFilesize
5.7MB
-
memory/1464-26-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1464-29-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1464-20-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/3160-39-0x0000000001890000-0x000000000189C000-memory.dmpFilesize
48KB
-
memory/3160-33-0x0000000000C60000-0x0000000000C6E000-memory.dmpFilesize
56KB
-
memory/3160-35-0x0000000001890000-0x000000000189C000-memory.dmpFilesize
48KB
-
memory/3160-34-0x0000000001280000-0x0000000001284000-memory.dmpFilesize
16KB
-
memory/3160-40-0x0000000001890000-0x000000000189C000-memory.dmpFilesize
48KB
-
memory/3160-31-0x0000000000C60000-0x0000000000C6E000-memory.dmpFilesize
56KB
-
memory/3160-43-0x0000000001890000-0x000000000189C000-memory.dmpFilesize
48KB
-
memory/3300-25-0x0000000075180000-0x0000000075731000-memory.dmpFilesize
5.7MB
-
memory/3300-28-0x0000000075180000-0x0000000075731000-memory.dmpFilesize
5.7MB
-
memory/3300-24-0x0000000000B40000-0x0000000000B50000-memory.dmpFilesize
64KB
-
memory/3300-19-0x0000000075180000-0x0000000075731000-memory.dmpFilesize
5.7MB