Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 13:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
229ed40d552df7f6945c547a76088f85.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
229ed40d552df7f6945c547a76088f85.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
229ed40d552df7f6945c547a76088f85.exe
-
Size
734KB
-
MD5
229ed40d552df7f6945c547a76088f85
-
SHA1
eb1ee94471caf81a6f6c3f40b9b3df7aa493bee1
-
SHA256
6dc67d242dcdf78000162614b046c9ca0282aa502574324c8de8ab7acbe420b6
-
SHA512
0d706f7ffe12b859142c2719c14ff82cdf780fa435dff9856e108efa1f9594b8b5dda4424fdd2b91e5cc9c412fa72196882760a4bc86dfa8d5929580c9121bd1
-
SSDEEP
12288:JaXTluCLqVRUQaBA/3oHET3PVt7bkstj6CcMii7rAi:4XxbOnUQaBAwHuPVt7bkcj9c1m
Score
10/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 229ed40d552df7f6945c547a76088f85.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation ntvdmd.exe -
Executes dropped EXE 2 IoCs
pid Process 4720 ntvdmd.exe 1304 UccApi.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\© Microsoft Real Time Media Stack = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\ntvdmd.exe" ntvdmd.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4668 set thread context of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 1304 set thread context of 1432 1304 UccApi.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 1304 UccApi.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 4720 ntvdmd.exe 1304 UccApi.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 4720 ntvdmd.exe 1304 UccApi.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 4720 ntvdmd.exe 1304 UccApi.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 4720 ntvdmd.exe 1304 UccApi.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 4720 ntvdmd.exe 1304 UccApi.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 4720 ntvdmd.exe 1304 UccApi.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 4720 ntvdmd.exe 1304 UccApi.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe 4720 ntvdmd.exe 1304 UccApi.exe 1304 UccApi.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4668 229ed40d552df7f6945c547a76088f85.exe 4720 ntvdmd.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeDebugPrivilege 4668 229ed40d552df7f6945c547a76088f85.exe Token: SeIncreaseQuotaPrivilege 3972 AppLaunch.exe Token: SeSecurityPrivilege 3972 AppLaunch.exe Token: SeTakeOwnershipPrivilege 3972 AppLaunch.exe Token: SeLoadDriverPrivilege 3972 AppLaunch.exe Token: SeSystemProfilePrivilege 3972 AppLaunch.exe Token: SeSystemtimePrivilege 3972 AppLaunch.exe Token: SeProfSingleProcessPrivilege 3972 AppLaunch.exe Token: SeIncBasePriorityPrivilege 3972 AppLaunch.exe Token: SeCreatePagefilePrivilege 3972 AppLaunch.exe Token: SeBackupPrivilege 3972 AppLaunch.exe Token: SeRestorePrivilege 3972 AppLaunch.exe Token: SeShutdownPrivilege 3972 AppLaunch.exe Token: SeDebugPrivilege 3972 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 3972 AppLaunch.exe Token: SeChangeNotifyPrivilege 3972 AppLaunch.exe Token: SeRemoteShutdownPrivilege 3972 AppLaunch.exe Token: SeUndockPrivilege 3972 AppLaunch.exe Token: SeManageVolumePrivilege 3972 AppLaunch.exe Token: SeImpersonatePrivilege 3972 AppLaunch.exe Token: SeCreateGlobalPrivilege 3972 AppLaunch.exe Token: 33 3972 AppLaunch.exe Token: 34 3972 AppLaunch.exe Token: 35 3972 AppLaunch.exe Token: 36 3972 AppLaunch.exe Token: SeDebugPrivilege 4720 ntvdmd.exe Token: SeDebugPrivilege 1304 UccApi.exe Token: SeIncreaseQuotaPrivilege 1432 AppLaunch.exe Token: SeSecurityPrivilege 1432 AppLaunch.exe Token: SeTakeOwnershipPrivilege 1432 AppLaunch.exe Token: SeLoadDriverPrivilege 1432 AppLaunch.exe Token: SeSystemProfilePrivilege 1432 AppLaunch.exe Token: SeSystemtimePrivilege 1432 AppLaunch.exe Token: SeProfSingleProcessPrivilege 1432 AppLaunch.exe Token: SeIncBasePriorityPrivilege 1432 AppLaunch.exe Token: SeCreatePagefilePrivilege 1432 AppLaunch.exe Token: SeBackupPrivilege 1432 AppLaunch.exe Token: SeRestorePrivilege 1432 AppLaunch.exe Token: SeShutdownPrivilege 1432 AppLaunch.exe Token: SeDebugPrivilege 1432 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 1432 AppLaunch.exe Token: SeChangeNotifyPrivilege 1432 AppLaunch.exe Token: SeRemoteShutdownPrivilege 1432 AppLaunch.exe Token: SeUndockPrivilege 1432 AppLaunch.exe Token: SeManageVolumePrivilege 1432 AppLaunch.exe Token: SeImpersonatePrivilege 1432 AppLaunch.exe Token: SeCreateGlobalPrivilege 1432 AppLaunch.exe Token: 33 1432 AppLaunch.exe Token: 34 1432 AppLaunch.exe Token: 35 1432 AppLaunch.exe Token: 36 1432 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3972 AppLaunch.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 3972 4668 229ed40d552df7f6945c547a76088f85.exe 90 PID 4668 wrote to memory of 4720 4668 229ed40d552df7f6945c547a76088f85.exe 93 PID 4668 wrote to memory of 4720 4668 229ed40d552df7f6945c547a76088f85.exe 93 PID 4668 wrote to memory of 4720 4668 229ed40d552df7f6945c547a76088f85.exe 93 PID 4720 wrote to memory of 1304 4720 ntvdmd.exe 95 PID 4720 wrote to memory of 1304 4720 ntvdmd.exe 95 PID 4720 wrote to memory of 1304 4720 ntvdmd.exe 95 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94 PID 1304 wrote to memory of 1432 1304 UccApi.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\229ed40d552df7f6945c547a76088f85.exe"C:\Users\Admin\AppData\Local\Temp\229ed40d552df7f6945c547a76088f85.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3972
-
-
C:\Users\Admin\AppData\Local\Temp\System\ntvdmd.exe"C:\Users\Admin\AppData\Local\Temp\System\ntvdmd.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\System\UccApi.exe"C:\Users\Admin\AppData\Local\Temp\System\UccApi.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD503c886af821f78c72b9f31a5ee9523bf
SHA100eb6757b298c1dbfd815672c4d66d88078f489f
SHA256225e869ca14f2ce166871f218c9ff7161ebd25b8ea521a563194d40729318247
SHA512d6d915b160019545ad77f62bf8aa25945fb142c105c2a0535c34139f83f2874412706d6be2e6d982a0a8f54caba2e4debf4446ede134c6c766510dbe942377f0