Overview
overview
10Static
static
10сентя...49.exe
windows7-x64
10сентя...49.exe
windows10-2004-x64
10сентя...df.exe
windows7-x64
10сентя...df.exe
windows10-2004-x64
10сентя...5d.exe
windows7-x64
8сентя...5d.exe
windows10-2004-x64
8сентя...ba.exe
windows7-x64
10сентя...ba.exe
windows10-2004-x64
10сентя...bd.exe
windows7-x64
7сентя...bd.exe
windows10-2004-x64
7сентя...14.exe
windows7-x64
3сентя...14.exe
windows10-2004-x64
3сентя...04.exe
windows7-x64
10сентя...04.exe
windows10-2004-x64
10сентя...73.exe
windows7-x64
10сентя...73.exe
windows10-2004-x64
сентя...4b.exe
windows7-x64
1сентя...4b.exe
windows10-2004-x64
10сентя...ee.exe
windows7-x64
3сентя...ee.exe
windows10-2004-x64
7сентя...75.exe
windows7-x64
3сентя...75.exe
windows10-2004-x64
7сентя...53.exe
windows7-x64
10сентя...53.exe
windows10-2004-x64
сентя...fa.exe
windows7-x64
10сентя...fa.exe
windows10-2004-x64
10сентя...e3.exe
windows7-x64
10сентя...e3.exe
windows10-2004-x64
10сентя...3a.exe
windows7-x64
3сентя...3a.exe
windows10-2004-x64
3сентя...25.exe
windows7-x64
10сентя...25.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
394s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 02:04
Static task
static1
Behavioral task
behavioral1
Sample
сентябрь 2023(570)/00053bf64ec3040b73c84979799768dba9a03c5f0d2f73512977c7030e29dd49.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
сентябрь 2023(570)/00053bf64ec3040b73c84979799768dba9a03c5f0d2f73512977c7030e29dd49.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
сентябрь 2023(570)/00985db874d9177de4a18999f7a420260b3a4665ba2b5b32aa39433ef79819df.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
сентябрь 2023(570)/00985db874d9177de4a18999f7a420260b3a4665ba2b5b32aa39433ef79819df.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
сентябрь 2023(570)/0110e1c3c1bd79626a55e770490d4ceba396e907c4cff4ec8d7c7293f6915e5d.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
сентябрь 2023(570)/0110e1c3c1bd79626a55e770490d4ceba396e907c4cff4ec8d7c7293f6915e5d.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
сентябрь 2023(570)/018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
сентябрь 2023(570)/018f7e7da2bf6e6cfd768c6ec8c568e0866654bd03eeb1e672d115811741e6ba.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
сентябрь 2023(570)/01e5ebc2c096d465800660a0ad6d62208a5b2b675e3700f3734fac225b1d38bd.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
сентябрь 2023(570)/01e5ebc2c096d465800660a0ad6d62208a5b2b675e3700f3734fac225b1d38bd.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
сентябрь 2023(570)/01fc4ee8bd9cd9c2ee70ccd486f4f3d1fdd42f40fffc6ab66e9f3973f2000e14.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
сентябрь 2023(570)/01fc4ee8bd9cd9c2ee70ccd486f4f3d1fdd42f40fffc6ab66e9f3973f2000e14.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
сентябрь 2023(570)/0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
сентябрь 2023(570)/0249c64b8858a7ba84f14c058f7a10d41ef807eb4f015ee34c6b388a3a2f1804.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
сентябрь 2023(570)/0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
сентябрь 2023(570)/0322477813c2550386f1bfa31c31fd9f70b4581df866d0a9b068170b2f6d3373.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
сентябрь 2023(570)/036db747914ccb896aa34f6c58f9f7b2343fb031c2fef98558925526941ad74b.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
сентябрь 2023(570)/036db747914ccb896aa34f6c58f9f7b2343fb031c2fef98558925526941ad74b.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
сентябрь 2023(570)/045cbc9ff518aa3bf58f568868c326af3ea7dea491e2543233885ecbaec30eee.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
сентябрь 2023(570)/045cbc9ff518aa3bf58f568868c326af3ea7dea491e2543233885ecbaec30eee.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
сентябрь 2023(570)/057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
сентябрь 2023(570)/057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
сентябрь 2023(570)/0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
сентябрь 2023(570)/0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
сентябрь 2023(570)/05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
сентябрь 2023(570)/05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
сентябрь 2023(570)/0651c1ebd22042c0f18964dcf445e7b4f350b2d7d01413040860a2187fdea5e3.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
сентябрь 2023(570)/0651c1ebd22042c0f18964dcf445e7b4f350b2d7d01413040860a2187fdea5e3.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
сентябрь 2023(570)/07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
сентябрь 2023(570)/07656dde7e964ab7e49378a310d439f5c3201528ec707e0b1a138d5c61b8d63a.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
сентябрь 2023(570)/0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
сентябрь 2023(570)/0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe
Resource
win10v2004-20231215-en
General
-
Target
сентябрь 2023(570)/057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe
-
Size
609KB
-
MD5
725cf8ad8ed8f096e03cd373c8abde91
-
SHA1
c8fa598234529b94280bdb8fceeeeafe326f9575
-
SHA256
057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75
-
SHA512
52bed1b613f897e6354b1c05d55880400937f288c8a7e32a3d4c15ce58e1efe25f7889114ccaf46626141491b862cfbb6f896c49ae200e686c70797617a07f8a
-
SSDEEP
12288:ICn9t5725IAGZ64fzBt3hQJ0FyqNI6EO96f4zU2c1MlBBW75NJiaxmwS:ICEQk4VzQJvqNI6vMwzU0XBfaxM
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3988 3644 WerFault.exe 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exepowershell.exepid process 3644 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe 3644 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe 3772 powershell.exe 3772 powershell.exe 3772 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exepowershell.exedescription pid process Token: SeDebugPrivilege 3644 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe Token: SeDebugPrivilege 3772 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exedescription pid process target process PID 3644 wrote to memory of 3772 3644 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe powershell.exe PID 3644 wrote to memory of 3772 3644 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe powershell.exe PID 3644 wrote to memory of 3772 3644 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe powershell.exe PID 3644 wrote to memory of 5092 3644 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe schtasks.exe PID 3644 wrote to memory of 5092 3644 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe schtasks.exe PID 3644 wrote to memory of 5092 3644 057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe"C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\057e86a5c22e1d0cc4a2c0e189fb5f118859a2554afcb111ebc280af9dc05c75.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OsKZUclncCXlX.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OsKZUclncCXlX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7CE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 17202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3644 -ip 36441⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iax5ywdx.vst.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpD7CE.tmpFilesize
1KB
MD56725a369927e839255e9f5daac3353cf
SHA16a72192f6590bfd2b981826856757db499bac2d3
SHA2567674bc207561b148d526a3bde2001081c542172807bef07929c16b8b08fd8c46
SHA512f12964a1379bb49a79367b89c99225a9e4bad38870bc46431e81c1b21c4e30df54a5f446a4a4f197e94c6ffb7c11b2511ac002d0223ee276564c4be7708f9817
-
memory/3644-6-0x00000000053D0000-0x000000000546C000-memory.dmpFilesize
624KB
-
memory/3644-3-0x0000000005130000-0x00000000051C2000-memory.dmpFilesize
584KB
-
memory/3644-4-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/3644-5-0x00000000051F0000-0x00000000051FA000-memory.dmpFilesize
40KB
-
memory/3644-2-0x00000000057D0000-0x0000000005D74000-memory.dmpFilesize
5.6MB
-
memory/3644-7-0x0000000005580000-0x0000000005590000-memory.dmpFilesize
64KB
-
memory/3644-8-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/3644-9-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/3644-10-0x00000000057A0000-0x00000000057AC000-memory.dmpFilesize
48KB
-
memory/3644-11-0x0000000007110000-0x000000000718C000-memory.dmpFilesize
496KB
-
memory/3644-37-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/3644-0-0x00000000006C0000-0x000000000075E000-memory.dmpFilesize
632KB
-
memory/3644-1-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/3772-24-0x00000000056D0000-0x0000000005736000-memory.dmpFilesize
408KB
-
memory/3772-51-0x00000000064A0000-0x00000000064BE000-memory.dmpFilesize
120KB
-
memory/3772-21-0x0000000004FC0000-0x00000000055E8000-memory.dmpFilesize
6.2MB
-
memory/3772-22-0x0000000004F40000-0x0000000004F62000-memory.dmpFilesize
136KB
-
memory/3772-23-0x0000000005660000-0x00000000056C6000-memory.dmpFilesize
408KB
-
memory/3772-18-0x0000000002590000-0x00000000025A0000-memory.dmpFilesize
64KB
-
memory/3772-17-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/3772-34-0x0000000005980000-0x0000000005CD4000-memory.dmpFilesize
3.3MB
-
memory/3772-35-0x0000000005F00000-0x0000000005F1E000-memory.dmpFilesize
120KB
-
memory/3772-36-0x0000000005F50000-0x0000000005F9C000-memory.dmpFilesize
304KB
-
memory/3772-16-0x0000000004950000-0x0000000004986000-memory.dmpFilesize
216KB
-
memory/3772-38-0x0000000002590000-0x00000000025A0000-memory.dmpFilesize
64KB
-
memory/3772-40-0x00000000064D0000-0x0000000006502000-memory.dmpFilesize
200KB
-
memory/3772-19-0x0000000002590000-0x00000000025A0000-memory.dmpFilesize
64KB
-
memory/3772-41-0x000000006EDE0000-0x000000006EE2C000-memory.dmpFilesize
304KB
-
memory/3772-39-0x000000007F050000-0x000000007F060000-memory.dmpFilesize
64KB
-
memory/3772-52-0x0000000007100000-0x00000000071A3000-memory.dmpFilesize
652KB
-
memory/3772-54-0x0000000007210000-0x000000000722A000-memory.dmpFilesize
104KB
-
memory/3772-53-0x0000000007850000-0x0000000007ECA000-memory.dmpFilesize
6.5MB
-
memory/3772-55-0x0000000007280000-0x000000000728A000-memory.dmpFilesize
40KB
-
memory/3772-56-0x0000000007490000-0x0000000007526000-memory.dmpFilesize
600KB
-
memory/3772-57-0x0000000007410000-0x0000000007421000-memory.dmpFilesize
68KB
-
memory/3772-58-0x0000000007440000-0x000000000744E000-memory.dmpFilesize
56KB
-
memory/3772-59-0x0000000007450000-0x0000000007464000-memory.dmpFilesize
80KB
-
memory/3772-61-0x0000000007530000-0x0000000007538000-memory.dmpFilesize
32KB
-
memory/3772-60-0x0000000007550000-0x000000000756A000-memory.dmpFilesize
104KB
-
memory/3772-64-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB