Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 09:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d70aff28f5214470d0304a937c0bf7a9.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
d70aff28f5214470d0304a937c0bf7a9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
d70aff28f5214470d0304a937c0bf7a9.exe
-
Size
647KB
-
MD5
d70aff28f5214470d0304a937c0bf7a9
-
SHA1
5cb1ef5c6839a60354fddc414a11cc41db2d31e8
-
SHA256
f8e15aed8f0dbb50430567161ad19fd6fb0554b49682ddb40c905ddb4d166f66
-
SHA512
43c3e2c43209a1c264a4eb80d9c0765677f19ec6b0888aa5e951cea977fe4d7e2714345413848c2ac21a35720945b2cb9fce0466069e3850e5d6689010b28e7c
-
SSDEEP
12288:9dzmboLo3Q4GWVFTMNDyq8W/sAhOBaKW5IcvBz1ZlF5UFGuookWvxV6hFgagP:91lch1FoNWtWkAWaNIMxvhKaA
Score
10/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation d70aff28f5214470d0304a937c0bf7a9.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation d70aff28f5214470d0304a937c0bf7a9.exe -
Executes dropped EXE 1 IoCs
pid Process 736 d70aff28f5214470d0304a937c0bf7a9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Office = "\\Microsoft Office Collection\\office365.exe" d70aff28f5214470d0304a937c0bf7a9.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Office = "C:\\Users\\Admin\\AppData\\Local\\Microsoft Office Collection\\office365.exe" d70aff28f5214470d0304a937c0bf7a9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3252 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 736 d70aff28f5214470d0304a937c0bf7a9.exe 736 d70aff28f5214470d0304a937c0bf7a9.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 736 d70aff28f5214470d0304a937c0bf7a9.exe 2332 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4764 d70aff28f5214470d0304a937c0bf7a9.exe Token: SeDebugPrivilege 736 d70aff28f5214470d0304a937c0bf7a9.exe Token: SeDebugPrivilege 2332 Taskmgr.exe Token: SeSystemProfilePrivilege 2332 Taskmgr.exe Token: SeCreateGlobalPrivilege 2332 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe 2332 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 736 d70aff28f5214470d0304a937c0bf7a9.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4764 wrote to memory of 736 4764 d70aff28f5214470d0304a937c0bf7a9.exe 95 PID 4764 wrote to memory of 736 4764 d70aff28f5214470d0304a937c0bf7a9.exe 95 PID 4764 wrote to memory of 736 4764 d70aff28f5214470d0304a937c0bf7a9.exe 95 PID 4764 wrote to memory of 4632 4764 d70aff28f5214470d0304a937c0bf7a9.exe 91 PID 4764 wrote to memory of 4632 4764 d70aff28f5214470d0304a937c0bf7a9.exe 91 PID 4764 wrote to memory of 4632 4764 d70aff28f5214470d0304a937c0bf7a9.exe 91 PID 4632 wrote to memory of 3252 4632 cmd.exe 94 PID 4632 wrote to memory of 3252 4632 cmd.exe 94 PID 4632 wrote to memory of 3252 4632 cmd.exe 94 PID 736 wrote to memory of 2332 736 d70aff28f5214470d0304a937c0bf7a9.exe 93 PID 736 wrote to memory of 2332 736 d70aff28f5214470d0304a937c0bf7a9.exe 93 PID 736 wrote to memory of 2332 736 d70aff28f5214470d0304a937c0bf7a9.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9.exe"C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:3252
-
-
-
C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9\d70aff28f5214470d0304a937c0bf7a9.exe"C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9\d70aff28f5214470d0304a937c0bf7a9.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:736
-
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9\d70aff28f5214470d0304a937c0bf7a9.exe
Filesize647KB
MD5d70aff28f5214470d0304a937c0bf7a9
SHA15cb1ef5c6839a60354fddc414a11cc41db2d31e8
SHA256f8e15aed8f0dbb50430567161ad19fd6fb0554b49682ddb40c905ddb4d166f66
SHA51243c3e2c43209a1c264a4eb80d9c0765677f19ec6b0888aa5e951cea977fe4d7e2714345413848c2ac21a35720945b2cb9fce0466069e3850e5d6689010b28e7c
-
C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9\d70aff28f5214470d0304a937c0bf7a9.exe
Filesize381KB
MD5e733dbb897499b3de3475ba26a1aed5a
SHA110f04da5626f5121768c9b3ddcdf526a5da6d9c8
SHA256f8502e3a0a9901db75f9527f92780ce202085d30578798bef5061cc3988ca553
SHA512eb9752bfbcd9f85f67590efccec00260a6dc4b9758566c7d20f48986d8aaa47a0f9daf9e95458db91b17b697a5c8c6b5b80a5ed8df890aa10f3f5bf5d5c369df
-
C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9\d70aff28f5214470d0304a937c0bf7a9.exe
Filesize92KB
MD59313d50ab052acb5454383699d248fc5
SHA1ec7e89fb18d1389648e10e991f017eae8da13c92
SHA2560415646d36a738a145a552f8e66dc9a9305e5cc2892c6b3a0b1e3ff4ce07343a
SHA51230b5762e7287152185532ec16b311ae15fa34b62d74303fa103962f95b9325d1cd45d334e3914ec429ead3c62c820b3d335a90998aa700412017840a8ea1e33b