eb27d4fc56e8a66e9fb47d0b73b752f963855ac169130d55a488709caa466bba

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.1MB
MD5

072932d63a4fdc222735e6f713a514ae
SHA1

cdb200e4c759600e4a83e450fbd67a7682526ea9
SHA256

eb27d4fc56e8a66e9fb47d0b73b752f963855ac169130d55a488709caa466bba
SHA512

c7512594cb7ee7d9d3b3f71ff8931441932473d25561d946f55aface0c704b01a4f7bbbc8fc53b30e1cf1be10030c91186988f0ba6183485037924bb83db8702
SSDEEP

24576:La5ou5FEgQHe/Hlh9dJs3duzm413cig9gUfHSA+U:EouPx/363duzm413cr9gUqZ

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 4 IoCs

evasion

Windows Service

T1543.003

pid	Process
2856	netsh.exe
3636	netsh.exe
1836	netsh.exe
3060	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
800	dc.exe
1284	svchost.exe
2732	dc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System\svchost.exe	file.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File opened for modification	C:\Windows\System\dc.exe	svchost.exe
File created	C:\Windows\System\xxx1.bak	file.exe
File opened for modification	C:\Windows\System\dc.exe	file.exe
File created	C:\Windows\System\svchost.exe	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2732	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
2732	powershell.exe
800	dc.exe
800	dc.exe
2560	file.exe
2560	file.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4624	powershell.exe
4624	powershell.exe
2732	dc.exe
2732	dc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2856	2560	file.exe	91
PID 2560 wrote to memory of 2856	2560	file.exe	91
PID 2560 wrote to memory of 3636	2560	file.exe	92
PID 2560 wrote to memory of 3636	2560	file.exe	92
PID 2560 wrote to memory of 2732	2560	file.exe	94
PID 2560 wrote to memory of 2732	2560	file.exe	94
PID 2560 wrote to memory of 4060	2560	file.exe	98
PID 2560 wrote to memory of 4060	2560	file.exe	98
PID 2560 wrote to memory of 800	2560	file.exe	101
PID 2560 wrote to memory of 800	2560	file.exe	101
PID 2560 wrote to memory of 800	2560	file.exe	101
PID 2560 wrote to memory of 5092	2560	file.exe	104
PID 2560 wrote to memory of 5092	2560	file.exe	104
PID 2560 wrote to memory of 1788	2560	file.exe	106
PID 2560 wrote to memory of 1788	2560	file.exe	106
PID 2560 wrote to memory of 1284	2560	file.exe	108
PID 2560 wrote to memory of 1284	2560	file.exe	108
PID 1284 wrote to memory of 1836	1284	svchost.exe	111
PID 1284 wrote to memory of 1836	1284	svchost.exe	111
PID 1284 wrote to memory of 3060	1284	svchost.exe	113
PID 1284 wrote to memory of 3060	1284	svchost.exe	113
PID 1284 wrote to memory of 4572	1284	svchost.exe	115
PID 1284 wrote to memory of 4572	1284	svchost.exe	115
PID 1284 wrote to memory of 4624	1284	svchost.exe	117
PID 1284 wrote to memory of 4624	1284	svchost.exe	117
PID 1284 wrote to memory of 2732	1284	svchost.exe	119
PID 1284 wrote to memory of 2732	1284	svchost.exe	119
PID 1284 wrote to memory of 2732	1284	svchost.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:2856
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:3636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4060
- C:\Windows\System\dc.exe
  "C:\Windows\System\dc.exe" /D
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:800
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /TN "Timer"
  2⤵
  PID:5092
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:1788
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1836
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:3060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- - C:\Windows\System\dc.exe
    "C:\Windows\System\dc.exe" /D
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
398a4a9f993c41984cf69d927a4a1be7

SHA1
326f2b191a4af51d2d854f0cf5bd9d8e66701d71

SHA256
73408ee6e65dca6f7b59eefa7ac905ce6fbf2a2241117fb573e637cda560c7fc

SHA512
f2b634bfe0c296e23fcf3e150c0228e2b4c91f735c30841989c215bfec798483520f60a3197b51578917cce670a9dd98e9dd54293a0e990de7bc92f1f5322020

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j41q34uw.1mk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\vmwajbl

Filesize
108KB

MD5
07232b64be72593980cd952e8f85017e

SHA1
61dba57cc51f4501ace3520e2cf559d8e42e04d7

SHA256
ef342bcc3c938c2fa9b38bc84019d8dce94d018372f7d9c29a8ee7ff3f0fc3a8

SHA512
d5417f270e14fe3437c0d017e037117001377379475531b70f9d6840548dd830117fbf62c152c9af09f586bdf944edac330bc560cca4fa45105269319e7158cb

Download Submit
C:\Windows\System\dc.exe

Filesize
763KB

MD5
0a50081a6cd37aea0945c91de91c5d97

SHA1
755309c6d9fa4cd13b6c867cde01cc1e0d415d00

SHA256
6606d759667fbdfaa46241db7ffb4839d2c47b88a20120446f41e916cad77d0b

SHA512
f0a4e9a3dc065df2182527b17077c822d4535db86bf61f5ee795ee469b15159560a8e81e60d3037f3de1bb38e92f0fc8a422c2656882650d699e2b96948f9846

Download Submit
C:\Windows\System\svchost.exe

Filesize
1.1MB

MD5
072932d63a4fdc222735e6f713a514ae

SHA1
cdb200e4c759600e4a83e450fbd67a7682526ea9

SHA256
eb27d4fc56e8a66e9fb47d0b73b752f963855ac169130d55a488709caa466bba

SHA512
c7512594cb7ee7d9d3b3f71ff8931441932473d25561d946f55aface0c704b01a4f7bbbc8fc53b30e1cf1be10030c91186988f0ba6183485037924bb83db8702

Download Submit
memory/1284-95-0x0000000140000000-0x0000000140218400-memory.dmp

Filesize
2.1MB

Download
memory/1284-67-0x0000000140000000-0x0000000140218400-memory.dmp

Filesize
2.1MB

Download
memory/1284-66-0x0000000140000000-0x0000000140218400-memory.dmp

Filesize
2.1MB

Download
memory/2560-1-0x0000000140000000-0x0000000140218400-memory.dmp

Filesize
2.1MB

Download
memory/2560-29-0x0000000140000000-0x0000000140218400-memory.dmp

Filesize
2.1MB

Download
memory/2560-3-0x0000000140000000-0x0000000140218400-memory.dmp

Filesize
2.1MB

Download
memory/2560-2-0x0000000140000000-0x0000000140218400-memory.dmp

Filesize
2.1MB

Download
memory/2560-0-0x0000000140000000-0x0000000140218400-memory.dmp

Filesize
2.1MB

Download
memory/2560-68-0x0000000140000000-0x0000000140218400-memory.dmp

Filesize
2.1MB

Download
memory/2732-28-0x0000013DF5B00000-0x0000013DF5B10000-memory.dmp

Filesize
64KB

Download
memory/2732-30-0x0000013DF5B00000-0x0000013DF5B10000-memory.dmp

Filesize
64KB

Download
memory/2732-4-0x0000013DF7CF0000-0x0000013DF7D12000-memory.dmp

Filesize
136KB

Download
memory/2732-37-0x00007FFE24D00000-0x00007FFE257C1000-memory.dmp

Filesize
10.8MB

Download
memory/2732-25-0x0000013DF5B00000-0x0000013DF5B10000-memory.dmp

Filesize
64KB

Download
memory/2732-24-0x0000013DF5B00000-0x0000013DF5B10000-memory.dmp

Filesize
64KB

Download
memory/2732-23-0x00007FFE24D00000-0x00007FFE257C1000-memory.dmp

Filesize
10.8MB

Download
memory/4060-26-0x000002406CF60000-0x000002406CF70000-memory.dmp

Filesize
64KB

Download
memory/4060-36-0x00007FFE24D00000-0x00007FFE257C1000-memory.dmp

Filesize
10.8MB

Download
memory/4060-27-0x00007FFE24D00000-0x00007FFE257C1000-memory.dmp

Filesize
10.8MB

Download
memory/4572-70-0x0000020C80110000-0x0000020C80120000-memory.dmp

Filesize
64KB

Download
memory/4572-71-0x0000020C80110000-0x0000020C80120000-memory.dmp

Filesize
64KB

Download
memory/4572-85-0x0000020C80110000-0x0000020C80120000-memory.dmp

Filesize
64KB

Download
memory/4572-69-0x00007FFE248A0000-0x00007FFE25361000-memory.dmp

Filesize
10.8MB

Download
memory/4572-119-0x00007FFE248A0000-0x00007FFE25361000-memory.dmp

Filesize
10.8MB

Download
memory/4624-82-0x00007FFE248A0000-0x00007FFE25361000-memory.dmp

Filesize
10.8MB

Download
memory/4624-83-0x000001426D1B0000-0x000001426D1C0000-memory.dmp

Filesize
64KB

Download
memory/4624-84-0x000001426D1B0000-0x000001426D1C0000-memory.dmp

Filesize
64KB

Download
memory/4624-97-0x000001426D1B0000-0x000001426D1C0000-memory.dmp

Filesize
64KB

Download
memory/4624-100-0x00007FFE248A0000-0x00007FFE25361000-memory.dmp

Filesize
10.8MB

Download