Overview

overview

8

Static

static

3

1181cfd2b3...55.exe

windows7-x64

8

1181cfd2b3...55.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 22:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55.exe

  • Size

    37KB

  • MD5

    c9888d06d21e682ae62498e24880d139

  • SHA1

    1dd9679e1792468116e7da109fdf3a89a4fa1bb2

  • SHA256

    1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55

  • SHA512

    205e2ed37e809bf7e7db818b5f55d99bfcaba55d3875301e5fb77285fb1e1c977b11ddd34358773145add1f405330f3b426b0c8bd0ab64600007e866c0ebc9ce

  • SSDEEP

    768:MetU1hGx8VAXQul37B5t8Rsr55U9EuB6SLFo5:M+uM5iCc9Po4O5

Score
8/10
evasionpersistence

Malware Config

Signatures

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55.exe
    "C:\Users\Admin\AppData\Local\Temp\1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1148
    • C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\cc"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:1820
    • C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\cc\$77cc.exe"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:3520
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA2D7.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:3768
      • C:\Users\Admin\AppData\Roaming\cc\$77cc.exe
        "C:\Users\Admin\AppData\Roaming\cc\$77cc.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4680
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks.exe" /query /TN $77cc.exe
          4⤵
            PID:100
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks.exe" /Create /SC ONCE /TN "$77cc.exe" /TR "C:\Users\Admin\AppData\Roaming\cc\$77cc.exe \"\$77cc.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
            4⤵
            • Creates scheduled task(s)
            PID:400
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks.exe" /query /TN $77cc.exe
            4⤵
              PID:3756

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_inzh0f0s.idb.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmpA2D7.tmp.bat
        Filesize

        152B

        MD5

        19548e55d7623a1848278087ba2c00b1

        SHA1

        419d83141c7d257ed1dadce10ce3c2b227740df2

        SHA256

        38b32134c227384a653a85a08001976e46aac0169ae1f3b093c2e5da861b1d79

        SHA512

        74cd600f09cad07c7eabe3878a8bba213bc7ba10bf4cbacd84aa0fb06703aef376ae0e3ad16d8745cdb4fdebc28048cc134bcd1591db1e09637e2dc42d807fcd

        Download Submit

      • C:\Users\Admin\AppData\Roaming\cc\$77cc.exe
        Filesize

        37KB

        MD5

        c9888d06d21e682ae62498e24880d139

        SHA1

        1dd9679e1792468116e7da109fdf3a89a4fa1bb2

        SHA256

        1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55

        SHA512

        205e2ed37e809bf7e7db818b5f55d99bfcaba55d3875301e5fb77285fb1e1c977b11ddd34358773145add1f405330f3b426b0c8bd0ab64600007e866c0ebc9ce

        Download Submit

      • memory/1148-0-0x0000000000B00000-0x0000000000B0C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1148-1-0x00007FF93C610000-0x00007FF93D0D1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1148-2-0x000000001C710000-0x000000001C720000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1148-3-0x00007FF93C610000-0x00007FF93D0D1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1148-9-0x00007FF93C610000-0x00007FF93D0D1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1420-14-0x000000001CC40000-0x000000001CC50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1420-13-0x00007FF93C610000-0x00007FF93D0D1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1420-31-0x00007FF93C610000-0x00007FF93D0D1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1420-32-0x000000001CC40000-0x000000001CC50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4680-25-0x00007FF93C610000-0x00007FF93D0D1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4680-27-0x0000023E7B130000-0x0000023E7B140000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4680-26-0x0000023E7B130000-0x0000023E7B140000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4680-24-0x0000023E7BAF0000-0x0000023E7BB12000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4680-30-0x00007FF93C610000-0x00007FF93D0D1000-memory.dmp

        Filesize

        10.8MB

        Download