Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2024, 10:12
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231215-en
General
-
Target
file.exe
-
Size
1.1MB
-
MD5
072932d63a4fdc222735e6f713a514ae
-
SHA1
cdb200e4c759600e4a83e450fbd67a7682526ea9
-
SHA256
eb27d4fc56e8a66e9fb47d0b73b752f963855ac169130d55a488709caa466bba
-
SHA512
c7512594cb7ee7d9d3b3f71ff8931441932473d25561d946f55aface0c704b01a4f7bbbc8fc53b30e1cf1be10030c91186988f0ba6183485037924bb83db8702
-
SSDEEP
24576:La5ou5FEgQHe/Hlh9dJs3duzm413cig9gUfHSA+U:EouPx/363duzm413cr9gUqZ
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 4 IoCs
pid Process 2856 netsh.exe 3636 netsh.exe 1836 netsh.exe 3060 netsh.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 3 IoCs
pid Process 800 dc.exe 1284 svchost.exe 2732 dc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System\svchost.exe file.exe File created C:\Windows\System\xxx1.bak svchost.exe File opened for modification C:\Windows\System\dc.exe svchost.exe File created C:\Windows\System\xxx1.bak file.exe File opened for modification C:\Windows\System\dc.exe file.exe File created C:\Windows\System\svchost.exe file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1788 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2732 powershell.exe 4060 powershell.exe 4060 powershell.exe 4060 powershell.exe 2732 powershell.exe 800 dc.exe 800 dc.exe 2560 file.exe 2560 file.exe 4572 powershell.exe 4572 powershell.exe 4572 powershell.exe 4624 powershell.exe 4624 powershell.exe 2732 dc.exe 2732 dc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 4060 powershell.exe Token: SeDebugPrivilege 4572 powershell.exe Token: SeDebugPrivilege 4624 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2560 wrote to memory of 2856 2560 file.exe 91 PID 2560 wrote to memory of 2856 2560 file.exe 91 PID 2560 wrote to memory of 3636 2560 file.exe 92 PID 2560 wrote to memory of 3636 2560 file.exe 92 PID 2560 wrote to memory of 2732 2560 file.exe 94 PID 2560 wrote to memory of 2732 2560 file.exe 94 PID 2560 wrote to memory of 4060 2560 file.exe 98 PID 2560 wrote to memory of 4060 2560 file.exe 98 PID 2560 wrote to memory of 800 2560 file.exe 101 PID 2560 wrote to memory of 800 2560 file.exe 101 PID 2560 wrote to memory of 800 2560 file.exe 101 PID 2560 wrote to memory of 5092 2560 file.exe 104 PID 2560 wrote to memory of 5092 2560 file.exe 104 PID 2560 wrote to memory of 1788 2560 file.exe 106 PID 2560 wrote to memory of 1788 2560 file.exe 106 PID 2560 wrote to memory of 1284 2560 file.exe 108 PID 2560 wrote to memory of 1284 2560 file.exe 108 PID 1284 wrote to memory of 1836 1284 svchost.exe 111 PID 1284 wrote to memory of 1836 1284 svchost.exe 111 PID 1284 wrote to memory of 3060 1284 svchost.exe 113 PID 1284 wrote to memory of 3060 1284 svchost.exe 113 PID 1284 wrote to memory of 4572 1284 svchost.exe 115 PID 1284 wrote to memory of 4572 1284 svchost.exe 115 PID 1284 wrote to memory of 4624 1284 svchost.exe 117 PID 1284 wrote to memory of 4624 1284 svchost.exe 117 PID 1284 wrote to memory of 2732 1284 svchost.exe 119 PID 1284 wrote to memory of 2732 1284 svchost.exe 119 PID 1284 wrote to memory of 2732 1284 svchost.exe 119 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes2⤵
- Modifies Windows Firewall
PID:2856
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes2⤵
- Modifies Windows Firewall
PID:3636
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Windows\System\dc.exe"C:\Windows\System\dc.exe" /D2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:800
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /TN "Timer"2⤵PID:5092
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM2⤵
- Creates scheduled task(s)
PID:1788
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
- Modifies Windows Firewall
PID:1836
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
- Modifies Windows Firewall
PID:3060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Windows\System\dc.exe"C:\Windows\System\dc.exe" /D3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5398a4a9f993c41984cf69d927a4a1be7
SHA1326f2b191a4af51d2d854f0cf5bd9d8e66701d71
SHA25673408ee6e65dca6f7b59eefa7ac905ce6fbf2a2241117fb573e637cda560c7fc
SHA512f2b634bfe0c296e23fcf3e150c0228e2b4c91f735c30841989c215bfec798483520f60a3197b51578917cce670a9dd98e9dd54293a0e990de7bc92f1f5322020
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
108KB
MD507232b64be72593980cd952e8f85017e
SHA161dba57cc51f4501ace3520e2cf559d8e42e04d7
SHA256ef342bcc3c938c2fa9b38bc84019d8dce94d018372f7d9c29a8ee7ff3f0fc3a8
SHA512d5417f270e14fe3437c0d017e037117001377379475531b70f9d6840548dd830117fbf62c152c9af09f586bdf944edac330bc560cca4fa45105269319e7158cb
-
Filesize
763KB
MD50a50081a6cd37aea0945c91de91c5d97
SHA1755309c6d9fa4cd13b6c867cde01cc1e0d415d00
SHA2566606d759667fbdfaa46241db7ffb4839d2c47b88a20120446f41e916cad77d0b
SHA512f0a4e9a3dc065df2182527b17077c822d4535db86bf61f5ee795ee469b15159560a8e81e60d3037f3de1bb38e92f0fc8a422c2656882650d699e2b96948f9846
-
Filesize
1.1MB
MD5072932d63a4fdc222735e6f713a514ae
SHA1cdb200e4c759600e4a83e450fbd67a7682526ea9
SHA256eb27d4fc56e8a66e9fb47d0b73b752f963855ac169130d55a488709caa466bba
SHA512c7512594cb7ee7d9d3b3f71ff8931441932473d25561d946f55aface0c704b01a4f7bbbc8fc53b30e1cf1be10030c91186988f0ba6183485037924bb83db8702