Analysis
-
max time kernel
136s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:21
Static task
static1
Behavioral task
behavioral1
Sample
documents.exe
Resource
win7-20231215-en
General
-
Target
documents.exe
-
Size
911KB
-
MD5
9530a4b5c2772de4edb6005f057c0405
-
SHA1
f544295bc15e8c1f69e9c2939acc88decfe404c8
-
SHA256
6e94f38fee814023e77c4f2f3f718fd0bdf456974fb7742c03ee17dd2054050c
-
SHA512
62d66a9cdaa81a4e651711dfa27de2dd0269a3200da8f62dd91a479bc925198caa9b4090cdf2e509832b9d226f1d33b28f5f66f6a30c7f0ad39f8f0e3f5f56ed
-
SSDEEP
12288:8SGnBbC8IABQRIVa8Tt5g0IhUSIw28Ph0S0NrlhjT2E6JbkpjPJaGbrKHaYl18/d:NEC+BVTUZX2HjTz6pmddYl10
Malware Config
Extracted
darkcloud
- email_from
- email_to
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
documents.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation documents.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
documents.exedescription pid process target process PID 3804 set thread context of 1636 3804 documents.exe documents.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
documents.exepowershell.exepid process 3804 documents.exe 3804 documents.exe 3804 documents.exe 3804 documents.exe 3804 documents.exe 3804 documents.exe 3804 documents.exe 3472 powershell.exe 3472 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
documents.exepowershell.exedescription pid process Token: SeDebugPrivilege 3804 documents.exe Token: SeDebugPrivilege 3472 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
documents.exepid process 1636 documents.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
documents.exedescription pid process target process PID 3804 wrote to memory of 3472 3804 documents.exe powershell.exe PID 3804 wrote to memory of 3472 3804 documents.exe powershell.exe PID 3804 wrote to memory of 3472 3804 documents.exe powershell.exe PID 3804 wrote to memory of 60 3804 documents.exe schtasks.exe PID 3804 wrote to memory of 60 3804 documents.exe schtasks.exe PID 3804 wrote to memory of 60 3804 documents.exe schtasks.exe PID 3804 wrote to memory of 1636 3804 documents.exe documents.exe PID 3804 wrote to memory of 1636 3804 documents.exe documents.exe PID 3804 wrote to memory of 1636 3804 documents.exe documents.exe PID 3804 wrote to memory of 1636 3804 documents.exe documents.exe PID 3804 wrote to memory of 1636 3804 documents.exe documents.exe PID 3804 wrote to memory of 1636 3804 documents.exe documents.exe PID 3804 wrote to memory of 1636 3804 documents.exe documents.exe PID 3804 wrote to memory of 1636 3804 documents.exe documents.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\documents.exe"C:\Users\Admin\AppData\Local\Temp\documents.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XDtKGBXwHkOLmY.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XDtKGBXwHkOLmY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB026.tmp"2⤵
- Creates scheduled task(s)
PID:60 -
C:\Users\Admin\AppData\Local\Temp\documents.exe"C:\Users\Admin\AppData\Local\Temp\documents.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ybbdasuw.voj.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpB026.tmpFilesize
1KB
MD58a212e2bc67d569f3d28b5890221914c
SHA1c1b73b6f6dfd82425f730a02a92a4fe20e357f48
SHA256fab21eeebd810a1c09932710d6b1bf98dfcfe4159ad202cf359cfbf8661c2983
SHA512811a265aaef7bb00187fe047fa2b0638cd6d955101e269d61e03a206b26df25d4e2162b8da9fea2321bd05cd8ca47416fb515e23100869e1402e84488235b66e
-
memory/1636-71-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/1636-25-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/1636-22-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/3472-44-0x000000007FA80000-0x000000007FA90000-memory.dmpFilesize
64KB
-
memory/3472-61-0x0000000007820000-0x000000000782A000-memory.dmpFilesize
40KB
-
memory/3472-70-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/3472-67-0x0000000007AD0000-0x0000000007AD8000-memory.dmpFilesize
32KB
-
memory/3472-65-0x00000000079F0000-0x0000000007A04000-memory.dmpFilesize
80KB
-
memory/3472-66-0x0000000007AF0000-0x0000000007B0A000-memory.dmpFilesize
104KB
-
memory/3472-64-0x00000000079E0000-0x00000000079EE000-memory.dmpFilesize
56KB
-
memory/3472-63-0x00000000079B0000-0x00000000079C1000-memory.dmpFilesize
68KB
-
memory/3472-19-0x00000000012D0000-0x00000000012E0000-memory.dmpFilesize
64KB
-
memory/3472-18-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/3472-17-0x0000000002B60000-0x0000000002B96000-memory.dmpFilesize
216KB
-
memory/3472-62-0x0000000007A30000-0x0000000007AC6000-memory.dmpFilesize
600KB
-
memory/3472-21-0x0000000005540000-0x0000000005B68000-memory.dmpFilesize
6.2MB
-
memory/3472-57-0x00000000012D0000-0x00000000012E0000-memory.dmpFilesize
64KB
-
memory/3472-24-0x00000000054B0000-0x00000000054D2000-memory.dmpFilesize
136KB
-
memory/3472-60-0x00000000077B0000-0x00000000077CA000-memory.dmpFilesize
104KB
-
memory/3472-26-0x0000000005CE0000-0x0000000005D46000-memory.dmpFilesize
408KB
-
memory/3472-59-0x0000000007DF0000-0x000000000846A000-memory.dmpFilesize
6.5MB
-
memory/3472-33-0x0000000005E40000-0x0000000005EA6000-memory.dmpFilesize
408KB
-
memory/3472-45-0x0000000006A40000-0x0000000006A72000-memory.dmpFilesize
200KB
-
memory/3472-41-0x0000000006110000-0x0000000006464000-memory.dmpFilesize
3.3MB
-
memory/3472-42-0x0000000006490000-0x00000000064AE000-memory.dmpFilesize
120KB
-
memory/3472-43-0x00000000064B0000-0x00000000064FC000-memory.dmpFilesize
304KB
-
memory/3472-56-0x0000000006A20000-0x0000000006A3E000-memory.dmpFilesize
120KB
-
memory/3472-46-0x0000000075640000-0x000000007568C000-memory.dmpFilesize
304KB
-
memory/3472-58-0x0000000007470000-0x0000000007513000-memory.dmpFilesize
652KB
-
memory/3804-38-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/3804-7-0x00000000090F0000-0x000000000918C000-memory.dmpFilesize
624KB
-
memory/3804-0-0x0000000000AC0000-0x0000000000BAA000-memory.dmpFilesize
936KB
-
memory/3804-2-0x0000000007F20000-0x00000000084C4000-memory.dmpFilesize
5.6MB
-
memory/3804-3-0x0000000007A60000-0x0000000007AF2000-memory.dmpFilesize
584KB
-
memory/3804-4-0x0000000007C80000-0x0000000007C90000-memory.dmpFilesize
64KB
-
memory/3804-5-0x0000000007B20000-0x0000000007B2A000-memory.dmpFilesize
40KB
-
memory/3804-12-0x0000000007C80000-0x0000000007C90000-memory.dmpFilesize
64KB
-
memory/3804-11-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/3804-10-0x000000000A5E0000-0x000000000A682000-memory.dmpFilesize
648KB
-
memory/3804-9-0x0000000007C70000-0x0000000007C7C000-memory.dmpFilesize
48KB
-
memory/3804-8-0x0000000007C60000-0x0000000007C68000-memory.dmpFilesize
32KB
-
memory/3804-6-0x0000000002F80000-0x0000000002F94000-memory.dmpFilesize
80KB
-
memory/3804-1-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB